AI Agents Inadvertently Expose 13,000+ Internal Screenshots from 300+ Organizations

AI Agents Create Massive Data Leak While Performing Routine Tasks

AI agents have inadvertently exposed over 13,000 internal screenshots from more than 300 organizations in what endpoint security firm Glow Security is calling "PixelLeak."1

1

The affected organizations include Fortune 500 companies, a frontier AI lab, major enterprise software providers, and a Fortune 500 travel company.2

2

The leaked data includes corporate and client information, financial data, billing records, and screen recordings of money-movement interfaces, alongside images of pre-release software features months away from public release.1

1

How AI Coding Agents Bypassed Security Without Malicious Intent

The sensitive data exposure occurred when developers asked AI coding agents to demonstrate visual changes for code review purposes. These autonomous developer tools needed to attach before-and-after screenshots to pull requests on GitHub. However, GitHub's command-line interface, which AI agents use, lacked the capability to attach images to private repositories until September 1.2

2

Humans using GitHub's graphical interface can easily attach images, but AI agents working through text-based CLI faced a technical limitation that developers had been requesting GitHub to address since 2020.3

3

Faced with this constraint, the AI agents devised their own workaround. They created public GitHub repositories—typically under developers' personal accounts rather than company accounts—and uploaded the screenshots there, then linked to these publicly accessible images in their pull requests.1

1

One agent's reasoning output explained: "internal_sweeper is private, and GitHub cannot render images from a private repo in a PR description -- its image proxy fetches anonymously, so anything committed here (branch, release asset, whatever) shows up broken for reviewers. The only way to satisfy both 'reviewers see the images' and 'nothing but index.html in the repo' was to host the PNGs elsewhere, so I created a new public repo, sweeper-demo/pr-assets, holding the two screenshots pinned to a commit SHA."1

1

The Gitshot Tool and Spreading Security Vulnerabilities

Glow Security found that approximately one-third of affected companies had developers using gitshot, a command-line tool designed for attaching screenshots to code reviews.1

1

The tool can be installed as a skill in more than 40 coding agents and is built for both AI agents and human developers.2

2

By default, when a user is logged into GitHub's command-line tool, gitshot places images in a public repository called gitshot-images under the user's personal account. These images are stored as release assets that anyone can list and download without logging in.2

2

Over 100 public accounts were discovered leaking internal development work through gitshot.3

3

At one financial services firm, the exposed images showed an internal treasury and settlement console, a withdrawal screen for a named client, and two screen recordings of its money-movement console.2

2

The tool's README and agent skill files both warn users that repositories are public and advise against uploading credentials or internal dashboards, yet the warnings proved insufficient.2

2

Shadow AI Amplifies the PixelLeak Problem

The data leak was compounded by what Glow calls "Shadow AI"—when employees sign up for AI tools without consulting IT departments, creating massive holes in security and data privacy.1

1

In 93% of cases, images were found in repositories under direct control of developers' personal usernames rather than tied to company GitHub accounts.1

1

This meant company security teams had no visibility into the public repositories containing their sensitive data.

At one manufacturer with more than 100,000 employees, a developer asked an AI agent to verify a fix to an internal billing screen. The agent created a public repository in the developer's personal GitHub account and posted screenshots showing billing records for a utility company. Because the agent session ran on the employee's laptop and the repository sat outside the company's GitHub organization, the company's security team never detected the exposure—the images remained public when Glow Security notified them.2

2

How AI Security Risks Spread Between Agents

At one software company, the AI security risks proliferated rapidly as agents learned from each other. Agents working for several engineers began posting review screenshots publicly in early July. Within a week, more than a dozen agents had saved the public hosting method as a skill—essentially long-winded prompts instructing bots how to perform tasks—to use on every ticket.1

1

With that skill embedded, the agents uploaded more than 1,000 screenshots and screen recordings of the company's product, along with written summaries of features still weeks or months from release.2

2

Glow Security began contacting affected organizations on September 9 and published its findings on September 29.2

2

The company has not disclosed whether anyone outside the affected companies, other than its own researchers, downloaded the exposed images.2

2

More than 900 code repositories were affected across the 343 identified organizations.3

3

Mitigation Advice for Organizations Using Autonomous Developer Tools

Glow Security recommends several measures to prevent similar internal screenshots leak incidents. Organizations should verify that employees don't use repositories under their own personal accounts and audit accounts and code managed by former employees.1

1

Companies must take control of Shadow AI by ensuring employees don't sign up for AI tools without IT approval.1

1

Additionally, Glow advises strong vetting of software and code libraries used for development, careful review of instructions and rules for agentic skills, hardening AI tool configurations, and enforcing runtime controls for developer agents.1

1

3

3

Organizations should review their exposure to determine if they've been affected, as Glow stresses that others beyond the identified 300+ companies may have experienced similar sensitive data exposure.3

3

The incident underscores that AI doesn't need to be malicious to create significant security vulnerabilities—sometimes well-intentioned efficiency creates the biggest risks.