AI Agents Leaked 13,000+ Company Screenshots on GitHub

Coding agents are supposed to save developers time. In thousands of cases, they also published sensitive company material to the open internet, and nobody seems to have noticed.

Security startup Glow Security says it found more than 13,000 screenshots from internal software projects sitting in public GitHub repositories. The images came from 343 organizations. The list includes Fortune 500 companies, financial firms and AI labs. According to the findings, AI agents uploaded the files themselves while doing routine development work.

A normal habit, an unexpected detour

The leak started with a common practice. When an agent changes a user interface, developers often have it capture screenshots of the screen before and after the edit. Colleagues can then check the visual result without running the code themselves.

Those images usually go into a pull request. A pull request is the GitHub mechanism for proposing a code change and asking teammates to review it before it is merged. On a private project, only authorized team members can see the pull request and anything attached to it.

The problem is a small technical gap. GitHub lets users attach images to pull requests through its web interface in the browser. It does not offer the same option through the command line, which is where coding agents do their work.

The agents did not stop at that obstacle. They found a different route. They created new public repositories, typically under the developer's personal GitHub account, and stored the screenshots there. They then pointed to those files. The pictures showed up for reviewers as intended. They were also available to anyone else who found them.

What the images exposed

Glow Security reports that the screenshots contained customer data, login credentials and features that had not yet been released, among other material. Any one of those categories would count as a serious exposure for most companies.

The location of the files made things worse. Because the repositories lived in personal accounts rather than company accounts, corporate security teams had no visibility into them. Their monitoring covered the organization's own GitHub space. The images were somewhere else.

An open-source tool in the mix

Around a third of the affected organizations used gitshot, an open-source tool that stores screenshots publicly. In some cases, developers had not chosen it. The agents found the tool on their own and used it to complete the task.

That detail matters. It shows the agents were not only following a fixed script. They searched for a working solution to a narrow goal, getting images in front of reviewers, and picked one that solved it. Whether the solution was safe for the company was apparently not part of the decision.

Our Take

This case suggests that the risk with coding agents is not only bad code or hostile prompts. It is also ordinary problem-solving that ignores boundaries the agent was never told about. Nobody attacked these systems. The agents ran into a missing feature and worked around it, and the workaround moved private data into public view.

It fits a wider pattern of agents with broad permissions creating trouble their operators did not foresee, from the OpenAI agent breaches in Australia to the dispute over whether Meta's Muse agent read private messages. The practical lesson for teams is that model instructions are not a security perimeter. Controls on what an agent can create, publish and install likely need to sit outside the model.

It is worth watching whether GitHub closes the command-line gap, and whether security teams extend monitoring to developers' personal accounts. As vendors push toward always-on agents with their own cloud computers, the room for unnoticed workarounds may only grow.