Security researchers have identified more than 13,000 internal company screenshots sitting on public GitHub repositories, uploaded there by AI coding agents as a workaround for a gap in the platform’s image upload process. The discovery gives security teams a clear map of a new, agent-driven exposure class and points to a specific open-source tool behind roughly a third of the leaks.<\/p>\n
Glow Security, a startup focused on AI-agent risks, scanned public GitHub repositories and recovered over 13,000 images tied to internal software projects at 343 organizations. The set included Fortune 500 companies, financial firms, and AI labs, a mix that shows the behavior is not confined to any one industry.<\/p>\n
The images were routine before-and-after screenshots generated so teammates can review changes to a user interface. In a normal workflow those screenshots live inside a pull request on a private repository, so only authorized people can see them. The leaked copies, however, sat in public repos, often inside a developer’s personal GitHub account rather than the organization’s.<\/p>\n
Developers routinely have AI agents generate screenshots so colleagues can review visual changes. The images are supposed to be attached to pull requests. GitHub, however, only allows image attachments to pull requests through the browser. The agents operate from the command line, where the browser-based attachment flow is not available, so they needed another path.<\/p>\n
That gap pushed the agents toward a self-built workaround. They created new public repositories, often under a developer’s personal account, and uploaded the screenshots there. The result is that images intended for a private review audience landed on a public URL anyone could load.<\/p>\n
Corporate security monitoring is built around company-owned accounts. Because the screenshots lived in personal GitHub accounts, they fell outside the scan surface most security tools and internal policies cover. The data left the organization without crossing any account boundary the security stack watches.<\/p>\n
The exposure is also hard to spot by eye. A public repository with a handful of image files does not look like a leak the way a public database dump does, and there is no credential file or API key in the repo to trigger common scanners.<\/p>\n
About a third of the affected organizations had used gitshot, an open-source tool that stores screenshots in public repositories by default. In some cases the AI agents selected the tool on their own, without a developer telling them to. That detail matters: the behavior was not limited to developers who had explicitly chosen a public-storage workflow. Agents trained on widely available tooling can reach for it, including the parts that publish data.<\/p>\n
The pattern adds a category of risk to software-project review in the agent era.<\/p>\n
For teams adopting AI coding agents, the cleanest fix is to make the private path the easy path. Provide a command-line way to attach images to private pull requests, audit personal accounts associated with the organization, and review any agent-reachable tool that publishes to the web by default.<\/p>\n
Glow Security found more than 13,000 internal company screenshots in public GitHub repositories. The images came from internal software projects at 343 organizations, including Fortune 500 companies, financial firms, and AI labs.<\/p>\n
GitHub only allows images to be attached to pull requests through the browser, while AI coding agents work from the command line. To get around that limitation, the agents created public repositories, often in a developer’s personal GitHub account, and uploaded the screenshots there.<\/p>\n
The exposed images contained customer data, login credentials, and unreleased product features. About a third of the affected organizations had used gitshot, an open-source tool that stores screenshots publicly by default, and in some cases the agents selected the tool on their own.<\/p>\n