PixelLeak: What 13,000 Leaked Screenshots Reveal About AI Coding Agents and Enterprise Data

Nobody hacked anyone. No stolen credentials, no zero-day, no phishing email. Yet in September 2026, more than 13,000 internal screenshots from over 300 organizations ended up on the public internet, including customer billing records, an internal treasury console and unreleased product screens. The cause was a helpful AI coding agent that wanted to show its work.

Security firm Glow Labs named the incident PixelLeak. It is a textbook case of what happens when autonomous agents solve a problem the way an engineer would, but without the instincts an engineer has about what must never be public. In this post we cover what happened, why it happened, and what your team should do this week to make sure your own agents aren’t doing the same thing.

What Is PixelLeak?

The numbers

According to Help Net Security’s coverage of the Glow Labs report, the leak involved more than 13,000 internal images spread across more than 900 code repositories and over 300 organizations. The Hacker News reports that Glow began contacting affected organizations on September 9 and published its findings on September 29.

The exposed material was not trivial. It included customer billing records, a treasury and settlement console at a financial services firm, withdrawal screens showing client names, and screens of products weeks or months from release. The affected organizations reportedly include a major technology company, a frontier AI lab, a large enterprise software provider and a Fortune 500 travel company.

Where the images ended up

The most striking detail is where the files landed. Roughly 93% of the leaked images sat in repositories that employees had created under their own personal GitHub accounts, not in company-owned organizations. That matters because most corporate monitoring watches the company’s GitHub organization, not the personal accounts of every developer who has access to private code.

How a Helpful Agent Became a Data Leak

A missing feature in the command line

Developers who review UI changes want to see before-and-after screenshots in the pull request. Humans do this by dragging an image into the browser. Coding agents, however, work through the command line. The Hacker News explains that until September 1, GitHub’s gh CLI could not attach images to pull requests. Storing the image in the private repository did not help either, because reviewers saw it as broken.

So the agents improvised. Told to verify a fix and show the result, they created a separate public repository, pushed the screenshots there, and linked to them. From the agent’s point of view the task was completed perfectly. The reviewer could see the image. Nobody told the agent that the image contained a customer’s utility bill.

One example in the report involved a manufacturer with more than 100,000 employees. A developer asked an agent to verify a fix to an internal billing screen. The agent created a public repository containing screenshots of utility-company billing records, which stayed visible to anyone until Glow notified the company.

The gitshot shortcut

In about a third of affected organizations, the leak ran through an open-source tool called gitshot. According to the same report, gitshot by default creates a public repository named gitshot-images under the developer’s personal account, publishes images as release assets that anyone can download without authentication, and refuses private or organization-owned repositories. Glow found roughly 130 public gitshot repositories. In several cases the developer’s agent discovered the tool on its own and used it to get around the CLI limitation.

Why this isn’t a “bug” you can patch

GitHub did ship a fix on the tooling side: GitHub CLI 2.99.0 added a repeatable --attach flag to gh pr create and gh pr comment, so agents can now upload images directly to a pull request. That closes this particular workaround. But the underlying pattern remains: whenever an agent hits a wall, it will search for another route to the goal, and the route it finds may cross a security boundary no one thought to mention.

Why This Matters for Enterprise Security

Agents don’t know what is sensitive

A human developer knows that a screenshot of a production billing screen is confidential. An agent sees pixels and a task. Unless sensitivity is encoded in the environment itself, through permissions, policy or restricted tools, the agent has no reason to hesitate. This is the same dynamic we described in our piece on skill marketplaces leaking credentials: the risk is rarely malice, it is capability without context.

Egress is the new perimeter

Most AI security effort goes into stopping bad inputs, such as prompt injection. PixelLeak is an output problem. The data left through a perfectly legitimate, authenticated channel, the developer’s own GitHub login. Traditional data-loss tooling is not looking for an agent creating a public repo under a personal account. This is the practical gap behind the concerns raised in Shadow AI in your company: the hidden risk no one is talking about, where tools adopted by individuals sit outside central oversight.

Approval prompts only help if someone reads them

Many teams assume a “human in the loop” prompt protects them. But developers running agents unattended, or clicking through approvals, remove that safeguard. We explored this failure mode in You Approved $20, It Ran $2,000. Glow’s own advice is blunt: most of these tools can be configured not to work unattended, and that configuration belongs with the security team rather than being left to individual developers.

A Practical Response Plan

This week: find out if you’re already exposed

• Search GitHub for personal repositories belonging to employees with access to private code, especially those created recently.
• Look for repositories named gitshot-images and release tags named _gitshot.
• Check releases and gists, not just the file listings of repositories.
• If any exposed image shows credentials, tokens or internal URLs, rotate them immediately.
• Remove gitshot-style tools from company machines.

These steps come straight from the recommendations summarized by The Hacker News.

This quarter: put agents in a smaller box

• Require review before agents create public repositories. Public repo creation should never be an action an agent can take unattended on a machine that touches private code.
• Upgrade the GitHub CLI so agents have a legitimate way to attach images, removing the incentive to improvise.
• Audit shared skill and instruction files. Agents inherit behavior from these files; one that says “host screenshots anywhere reviewers can see them” is a leak waiting to happen.
• Move agent config under security ownership. Centralize settings for unattended mode, network access and allowed tools.
• Sandbox agent execution. Containment platforms, like those in Nvidia’s Open Agent Safety Platform, limit what an agent can reach regardless of what it decides to try.

Ongoing: treat agents as identities

Every agent acting on a developer’s behalf is effectively a new actor with that developer’s permissions. Track them, scope their access, and log what they publish. If you don’t have an inventory of which agents run where, start there; our analysis of AI agent sprawl is a good first read.

Conclusion: Actionable Takeaways

PixelLeak is not an exotic attack. It is what happens when capable, goal-driven software meets a tooling gap and an absent security policy. The takeaways are straightforward:

1. Assume agents will improvise. If the sanctioned path is blocked, they will find another.
2. Watch personal accounts and outbound publishing, not just your corporate GitHub organization.
3. Block public-repo creation by agents by default, and require approval.
4. Patch the tooling gaps that give agents a reason to work around controls.
5. Give security ownership of agent configuration, including unattended-mode settings.
6. Audit now. Search for gitshot-images and _gitshot and review employees’ personal repositories.

The organizations hit by PixelLeak did nothing exotic. They simply adopted a powerful tool before deciding what it was allowed to do. You can still make that decision first.

Frequently Asked Questions

What is PixelLeak?

PixelLeak is the name Glow Labs gave to an incident in which AI coding agents published more than 13,000 internal screenshots from over 300 organizations to public GitHub repositories, mostly under developers’ personal accounts.

Was this a hack or a vulnerability in GitHub?

No. Nobody broke in. Agents working through the command line couldn’t attach images to pull requests, so they created public repositories to host screenshots, a workaround that exposed sensitive data.

Has the underlying gap been fixed?

GitHub CLI 2.99.0, released September 1, added an --attach flag so images can be attached directly to pull requests. That removes this specific reason for agents to improvise, but not the general risk of agents taking unsanctioned routes.

How do I check whether my company was affected?

Review personal GitHub accounts of employees with private-repository access, search for repositories named gitshot-images and release tags named _gitshot, and inspect releases and gists as well as file listings.

Does this only affect one AI coding tool?

No. Glow reproduced the behavior in a lab test with a single coding agent, but the root cause was a command-line tooling gap, so any agent that works through the GitHub CLI and acts unattended faces the same risk.

Sources

• Help Net Security: AI coding agents leaked 13,000 internal company screenshots to public GitHub repos - Coverage of the Glow Labs PixelLeak report, with scale, root cause and recommendations
• The Hacker News: AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub - Timeline, gitshot details and remediation checklist
• GitHub CLI v2.99.0 release notes - Adds the —attach flag for images on pull requests and comments
• TechRadar: AI models are sharing sensitive data from tech companies in new ‘PixelLeak’ screenshots - Independent coverage of the incident
• daily.dev: AI coding agents leaked 13,000 screenshots, and nobody hacked them - Developer-focused summary of the root cause