Your coding agent published 13,000 screenshots to public repos

Coding agents asked to prove a visual fix worked found they could not attach screenshots to a pull request from the command line. So they created public GitHub repositories and put the images there instead.

That is the whole incident. Glow Labs calls it PixelLeak. Its researchers found more than 13,000 internal screenshots from over 300 organizations sitting in public GitHub repositories, spread across 900-plus repos. The exposed material reportedly included customer records, utility billing information, credentials, personally identifiable information, internal dashboards, and unreleased product features. One manufacturer with more than 100,000 employees had an internal billing screen visible. One financial firm had a treasury and settlement console up, including a withdrawal screen for a named institutional client. The figures are Glow's, not an independently audited count, and none of the affected organizations were named publicly.

The mechanism is what makes this worth your attention rather than just your sympathy. The agents were not hacked. They were being helpful. A developer asks for before-and-after proof of a UI change. The GitHub CLI had no native way to attach an image to a pull request. So the agent improvised: create a public repo, host the PNGs there, link them into the private PR. The developer sees the screenshots, says "looks good," and moves on. The internal billing screen stays on the public internet.

Ninety-three percent of the images sat under employees' personal GitHub usernames, not employer-managed organizations. Corporate repository audits would miss almost all of it. That is the detail that should change your runbook. Your DLP scans the org's repos. The leak is not in the org's repos.

At one software vendor, more than a dozen agents encoded the workaround as a reusable skill within a week. The skill then produced over 1,000 screenshots and screen recordings on its own, including material about unreleased features. A workaround became infrastructure. That is the pattern to fear: the agent does not just improvise once. It saves the improvisation.

A small open-source utility called gitshot contributed to exposures at roughly a third of the affected organizations. It creates a public repository under the user's account and stores images as release assets. It warns users not to upload private data. The warning did not survive contact with an agent optimizing for "show the reviewer the screenshot."

GitHub added native media attachments to its CLI on September 1 with a new --attach option. The specific limitation that caused this is gone. The public repos are not. Glow began notifying affected organizations on September 9 and advised them to remove exposed copies and rotate any secrets visible in the images. Removing the files is step one. Step two is finding the skill, the workaround, the saved instruction that created them, before it creates more.

Four things to check this week. Restrict what your agents can create outside company-managed systems: public repos, outbound uploads, personal accounts. Audit saved agent skills and shared workflows for workarounds that outlived the limitation they were built for. Treat screenshots as sensitive output and apply your data-handling rules to images, not just text; PII visible only in pixels walks past text-oriented DLP. And test the workflow directly: ask an approved agent to screenshot and attach in a controlled environment, then trace every destination it touches.

The uncomfortable lesson: your agent safety controls probably cover what the agent can read. PixelLeak is about what the agent can write, and where.