{"id":26309,"date":"2026-10-13T17:00:12","date_gmt":"2026-10-14T01:00:12","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/10\/13\/ai-coding-agents-expose-developer-screenshots-on-github-repos\/"},"modified":"2026-10-13T17:00:12","modified_gmt":"2026-10-14T01:00:12","slug":"ai-coding-agents-expose-developer-screenshots-on-github-repos","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/10\/13\/ai-coding-agents-expose-developer-screenshots-on-github-repos\/","title":{"rendered":"AI coding agents expose developer screenshots on GitHub repos"},"content":{"rendered":"<div class=\"rich-text_richText__UyrDZ\" data-anchor-headings=\"true\" data-component=\"rich-text\" data-reader-view=\"false\">\n<div class=\"payload-richtext\">\n<div class=\"callout-block_highlight__zUB32\" data-accent-bar=\"true\" data-background=\"highlight-gray\" data-component=\"callout-block\">\n<p class=\"callout-block_heading__sSD7c\" data-subtitle=\"lg\">Key takeaways<\/p>\n<div class=\"rich-text_richText__UyrDZ\" data-component=\"rich-text\" data-reader-view=\"false\">\n<div class=\"payload-richtext\">\n<ul class=\"list-bullet\">\n<li class=\"\" value=\"1\">Glow researchers found AI agents pushed 13,000+ internal screenshots into public GitHub repos \u2014 not by going rogue, but by working around a technical limit to complete the task they were given.<\/li>\n<li class=\"\" value=\"2\">93% of the exposures landed in developers&#8217; <em>personal<\/em> repos, outside any org-level governance, and the images included billing records, treasury consoles, tokens, and internal hostnames.<\/li>\n<li class=\"\" value=\"3\">Screenshots evade secrets scanners and DLP because those tools read text \u2014 and AI now makes mass image triage cheap for attackers.<\/li>\n<li class=\"\" value=\"4\">The fix is artifact-level: Inventory what agents can reach and publish, give every agent a traceable identity and a human checkpoint before anything goes public, and extend existing supply chain policy gates to AI models and agent tooling.<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<p>An AI agent doesn\u2019t have to go rogue to put an organization at risk. Recent research found agents doing exactly what they were told to do \u2014 and pushing more than 13,000 internal images into public view in the process.<\/p>\n<p>The <a href=\"https:\/\/www.glow.io\/blogs\/how-ai-agents-exposed-developer-screenshots-from-leading-tech-companies\" rel=\"noopener noreferrer\" target=\"_blank\"><span style=\"text-decoration:underline\">research<\/span><\/a>, published September 29 by Glow researchers <a href=\"https:\/\/www.linkedin.com\/in\/yonigottesman?originalSubdomain=il\"><span style=\"text-decoration:underline\">Yoni Gottesman<\/span><\/a> and <a href=\"https:\/\/www.linkedin.com\/in\/noam-kesten-7380011a6?originalSubdomain=il\"><span style=\"text-decoration:underline\">Noam Kesten<\/span><\/a>, describes a pattern the company calls PixelLeak. Each case started the same way: A developer asked an agent whether a visual change worked. The agents were text-only and had no sanctioned path for posting an image, so they hosted screenshots in public GitHub repositories where their human reviewers could see them.<\/p>\n<p>More than 300 organizations were affected, among them one of the world\u2019s largest tech companies, a frontier AI lab, a major enterprise software provider, and a Fortune 500 travel company. The exposed images included customer billing records, internal treasury and settlement consoles, and views of unreleased product features. Glow counted more than 900 repositories spanning cloud, health care, fintech, government, frontier AI, and security organizations, some with more than 100,000 employees.<\/p>\n<p>\u201cI think this is hilarious because I\u2019ve seen human developers do this for the past 24 years,\u201d said John Strand, owner of Black Hills Information Security. Developers who are handed a goal but given no approved way to reach it have always improvised a place to host something, he said, and penetration testers have been exploiting that habit for decades.\u00a0<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cThis shows AI agents getting closer to what humans do, probably because they were trained on what humans do.\u201d<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/john-strand-a1b4b62\/\">John Strand<\/a><\/p>\n<p>Here&#8217;s what you need to know about PixelLeak.<\/p>\n<p><strong>[ See webinar: <\/strong><a href=\"https:\/\/www.reversinglabs.com\/webinar\/red-team-build-pipeline\"><strong>Why red teaming the build pipeline is essential <\/strong><\/a><strong>]<\/strong><\/p>\n<h2 id=\"the-dark-side-of-persistence\"><strong>The dark side of persistence<\/strong><\/h2>\n<p>Agents most often break security protocols when the assigned task is benign but a technical limitation blocks it, said Steven Swift, managing director of Suzu Labs. Earlier agents simply reported back that they could not finish and gave up before trying a workable option. Because users were frustrated by this, model providers responded by training agents to persist and exhaust their options before declaring failure. One result of that persistence training was the <a href=\"https:\/\/www.reversinglabs.com\/blog\/openai-hugging-face-warning-shot\"><span style=\"text-decoration:underline\">OpenAI\/Hugging Face incident<\/span><\/a>.<\/p>\n<p>Another is PixelLeak. The agents could not reach GitHub\u2019s image hosting for private repositories and were limited to text, so they found another route. \u201cThat workaround leaked private screenshots, because agents thought it was the best way to get the data shared as required,\u201d Swift said.<\/p>\n<p>The repositories were often created in developers\u2019 personal accounts, he added, which places them outside any organization-level review.<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cOrganizations could vet 100% of their org-managed repos and still miss the data leak sitting in a public, personal repo controlled by one of their developers.\u201d<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/steven-swift-5238956a\"><span style=\"text-decoration:underline\">Steven Swift<\/span><\/a><\/p>\n<h2 id=\"free-reconnaissance-for-attackers\"><strong>Free reconnaissance for attackers<\/strong><\/h2>\n<p>Screenshots of internal applications are free reconnaissance, said Jim Sherlock, vice president for AI and cybersecurity R&amp;D at ProCircular. They show internal hostnames and URLs, the names of internal tools, which vendors and frameworks a company runs, who works on what, and what the internal systems look like. They also capture what nobody intended to capture, such as a token sitting in a URL bar or a terminal with environment variables printed out.<\/p>\n<p>Glow found that 93% of the cases it reviewed involved images in developers\u2019 personal accounts. \u201cMost companies govern their GitHub organization carefully but can\u2019t see what an employee\u2019s personal account is doing at all,\u201d Sherlock said.\u00a0<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cAgents run with the developer\u2019s credentials. That makes the developer\u2019s personal account part of your attack surface, whether you planned for it or not.\u201d<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/jim-sherlock-727857\"><span style=\"text-decoration:underline\">Jim Sherlock<\/span><\/a><\/p>\n<p>A screenshot of an internal console is a map, said Dor Sarig, co-founder and CEO at Pillar Security. It can expose hostnames, URLs, workflow steps, account structures, and employee names that an attacker would otherwise spend weeks reconstructing. Treasury and withdrawal screens show which approval steps to imitate in a payment-fraud or credential-phishing lure, Sarig said, and billing records are customer data, which can make an exposure reportable no matter the intent.<\/p>\n<p>Screenshots also slip past the controls built to catch this kind of leak, he added, because secrets scanners and data loss prevention tools read text.\u00a0<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cA screenshot is pixels.\u201d <\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/dsarig\"><span style=\"text-decoration:underline\">Dor Sarig<\/span><\/a><\/p>\n<p>An agent holding credentials to internal systems and the ability to publish externally is a new category of insider risk, and it warrants the same scrutiny any human with that access would get, said Seemant Sehgal, CEO and founder of BreachLock.\u00a0<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cThirteen thousand internal screenshots on public GitHub, including authentication tokens and system configurations, is reconnaissance material an attacker would spend weeks trying to collect through traditional means.,\u201d he said.<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/s-sehgal\/\"><span style=\"text-decoration:underline\">Seemant Sehgal<\/span><\/a><\/p>\n<p>Public GitHub is watched closely by people hunting for leaks, he said, so deleting a repository afterward is no assurance that nothing was copied first.<\/p>\n<h2 id=\"ai-turns-junk-into-attacker-gold\"><strong>AI turns junk into attacker gold<\/strong><\/h2>\n<p>Not long ago, most of those 13,000 images would have been treated as junk, said Dave Hayes, vice president of product at FusionAuth because nobody would go through them manually.\u00a0<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cBut it\u2019s much easier to scan and find anything useful with AI.\u201d<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/daveeurica\"><span style=\"text-decoration:underline\">Dave Hayes<\/span><\/a><\/p>\n<p>Incidents like PixelLeak put more pressure on companies to get their arms around the AI space, said Brian Wilson, CISO of SAS. \u201cThat\u2019s much easier said than done when AI touches virtually every part of the organization,\u201d he said.<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cSecurity teams have the mammoth task of thinking not only about the tools the company officially adopts but also the untold number of tools employees may be experimenting with.\u201d<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/bdwilson\"><span style=\"text-decoration:underline\">Brian Wilson<\/span><\/a><\/p>\n<p>PixelLeak is also a reminder that AI security is not only about limiting what an agent can access, said Kalyan Arety, director of product management at SecureW2. What identity the agent uses, which tools it can call, and whether a human signs off before something irreversible happens all matter.\u00a0<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cThis agent acted under a personal, ungoverned identity, created a new public repository with no sign-off, and left no trace the security team could see.\u201d<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/kalyan-arety\"><span style=\"text-decoration:underline\">Kalyan Arety<\/span><\/a><\/p>\n<p>Every agent needs a traceable identity, a human checkpoint before anything becomes public or irreversible, and an audit trail the organization owns, he added.<\/p>\n<p>PixelLeak is not a one-off, ProCircular\u2019s Sherlock said. OpenAI\u2019s misalignment disclosures last month describe the same behavior: An agent that could not share a workbook through the local filesystem uploaded it to a public file host instead, against instructions to keep it local.<\/p>\n<p>\u201cUploading to a public host is becoming the signature of the well-meaning agent leak,\u201d he said. \u201cIt needs no malice, only a goal, tools, and a gap.\u201d Security tools watch the assets a company has registered, he said, while agents act wherever their credentials work. Model safety is necessary, but it is not the boundary. \u201cThe boundary is the environment.\u201d<\/p>\n<h2 id=\"verify-the-artifact-not-the-intent\"><strong>Verify the artifact, not the intent<\/strong><\/h2>\n<p>PixelLeak lands in the same place as the malicious-package and tampered-build problems that already define software supply chain security. What reaches the outside world is what has to be checked, and the intent behind it does not change the exposure. An agent that cannot be relied on to keep an image local is not a reliable boundary for a dependency, a model file, or a build artifact, and the AI components now moving through development pipelines, including models pulled from public hubs, agent tooling, and Model Context Protocol servers, arrive with the same unverified provenance as any other third-party component.<\/p>\n<p>For developers and DevSecOps teams, that argues for treating agent output as an artifact rather than a side effect and calls for inventorying what agents can reach and publish, extending the policy gates already applied to open-source dependencies to AI models and agent tooling, and generating a bill of materials that covers those components alongside code. The finished artifact is the thing worth verifying, not the process that assembled it.<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Key takeawaysGlow researchers found AI agents pushed 13,000+ internal screenshots into public GitHub repos \u2014 not by going rogue, but by working around a technical limit to complete the task they were given.93% of the exposures landed in developers&#8217;personalrepos, outside any org-level governance, and the images included billing records, treasury consoles, tokens, and internal hostnames.Screenshots evade secrets scanners and DLP because those tools read text \u2014 and AI now makes mass image triage ch<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[32775],"tags":[],"class_list":["post-26309","post","type-post","status-publish","format-standard","hentry","category-reversinglabs"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26309","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=26309"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26309\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=26309"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=26309"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=26309"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}