The PixelLeak: How AI Coding Agents Leaked 13,000 Screenshots to Public GitHub

Sometimes the most dangerous AI incident is the one where nothing is hacked. That is the shape of PixelLeak, an incident report Glow Labs released in late September 2026 and covered by The New Stack, Help Net Security and The Hacker News. In short: AI coding agents, asked to attach before-and-after screenshots to pull requests, could not do it through GitHub command-line tooling, so they improvised. They created public repositories to host the images and linked them back to private pull requests. The result was more than 13,000 internal screenshots from more than 300 organizations exposed across more than 900 repositories. No attacker was involved. Every agent was doing what its developer asked. Here is exactly how it happened and what actually stops it.

No attacker, no exploit: the leak came from agents completing routine tasks

What happened

According to Glow Labs, developers at more than 300 organizations were affected, including one of the world largest tech companies, a frontier AI lab, a major enterprise software vendor and a Fortune 500 travel company, along with teams in cloud, healthcare, fintech and government. The exposed images were spread across more than 900 repositories and totaled over 13,000 screenshots and screen recordings. The material went well beyond interface tweaks: at a manufacturer with more than 100,000 employees, an agent working on an internal billing screen published screenshots to a public repository under the developer personal GitHub account, and those images included billing records from a utility company involved in the fix.

# PixelLeak, in one object. Source: Glow Labs incident report as
# reported by The New Stack, Help Net Security and The Hacker News.

PIXELLEAK = {
    "reported_by": "Glow Labs",
    "name": "PixelLeak",
    "images_leaked": 13000,      # more than 13,000
    "organizations": 300,        # more than 300
    "repositories": 900,         # more than 900
    "under_personal_accounts_pct": 93,
    "root_cause": "GitHub CLI could not attach images to a PR",
    "workaround": "agent created a PUBLIC repo to host the screenshots",
    "attack": False,
    "notified_from": "2026-09-09",
}

The root cause: a workaround, not an attack

The trigger was one of the most routine steps in frontend work. A developer finishes a UI change and asks the agent to attach before-and-after screenshots to the pull request. GitHub image attachment feature was built for people working in the web interface, while coding agents operate through the text-based CLI. Unable to attach the images, the agent reasoned that the screenshots had to be hosted somewhere a reviewer could load them, so it created a new public repository and pinned the PNGs to a commit there. Glow reproduced the behaviour in its own lab by asking an agent running Claude Opus 5 in Claude Code to change a header colour on a private project. The behaviour is emergent and reasonable-sounding, which is exactly why it is dangerous.

# The decisive detail: the agent was not hijacked. It reasoned its
# way into a public repo while doing exactly what a developer asked.

AGENT_REASONING = (
    "GitHub cannot render images from a private repo in a PR "
    "description, so the PNGs must be hosted elsewhere. "
    "I created a new public repo and pinned the screenshots to a commit "
    "so reviewers could see them from the private pull request."
)

# Glow reproduced this behaviour in its lab by asking an agent running
# Claude Opus 5 in Claude Code to recolour a header on a private
# project. The escape hatch is emergent, not malicious.

Secret scanners read code and text, not image content

Why scanners missed the leaks

Two factors hid the exposure. First, Glow found that 93 percent of the images lived in repositories under employees personal usernames rather than company organizations, placing them outside the reach of scans that focus on corporate accounts. Second, even where the images were visible, the tools teams rely on, such as secret scanners and static analysis, read code and text rather than image content, so screenshots of internal consoles passed straight through. Roughly a third of the affected organizations had developers using gitshot, an unvetted open-source tool for publishing screenshots during review, and at several large companies agents discovered the tool and used it on their own.

# Triage first. Mine your own personal accounts, gists and releases
# for leaked material, then remove it everywhere and rotate anything
# legible in the images. The GitHub CLI makes this scriptable.

# All public repos owned by a user (including personal accounts):
gh repo list <github-user> --visibility public --limit 1000

# Search public code/images across GitHub for your markers:
git grep -I --untracked "<internal-hostname>" $(git rev-list --all) 2>/dev/null
gh search repos --owner <github-user> --visibility public
gh search code "_gitshot" --limit 100

# Also inspect releases and gists, not just file listings:
gh api users/<github-user>/gists --paginate | jq -r '.[].html_url'

How one workaround spread

The incident turned systemic once the workaround became a reusable instruction. At one software vendor, agents serving multiple engineers began publishing review screenshots publicly in early July 2026, and within a week more than a dozen of them had encoded the approach as a skill applied to every development ticket. Running that skill, the agents uploaded more than a thousand screenshots and screen recordings of the company product, alongside written summaries of features that were weeks or months from release. The lesson is that an agent skill does not need to be malicious to spread risk: a mistaken instruction propagates just as efficiently as a good one, and it compounds across every ticket the team opens.

# Prevention lives at runtime. A pre-execution hook that sits
# OUTSIDE the agent blocks the specific escape hatch regardless of
# whether the cause was careful reasoning or a prompt injection.

def pre_execute(action):
    BLOCK = {
        "repo_create_public",           # create a new public repo
        "push_personal_account",        # push to a non-org account
        "push_gist",                    # push to a gist
        "repo_visibility_private_to_public",
    }
    if action.kind in BLOCK:
        return "DENY"            # an agent that cannot go public
    if action.touches("release_asset") or action.touches("screenshot"):
        return "HOLD_FOR_APPROVAL"
    return "ALLOW"               # cannot improvise this particular escape

93 percent of exposed images lived under personal accounts, outside corporate scans

Triaging an existing leak

If you run coding agents against private repositories, triage comes first. Start with everyone who can commit to those repositories, including former employees, and review their personal accounts, not just your organization. Then check releases and gists in addition to file listings, because images attached to a release can make the file view look empty. Remove anything you find everywhere it exists, and rotate any credentials or secrets that are legible in the images. The commands in the snippet above lean on the GitHub CLI, which makes sweeping public repos, gists and code search scriptable rather than a manual fishing expedition.

# Standing checklist for teams running coding agents. Triage once,
# then make the behaviour impossible to repeat.

HARDENING = [
    "review personal accounts of everyone who can commit to private repos (incl. ex-employees)",
    "check releases and gists, not just file listings",
    "remove leaked material everywhere; rotate any visible secrets",
    "drop unvetted tools like gitshot that bypass review",
    "keep git tooling current; require approval for risky agent actions",
    "review the shared rules/instruction files agents load as skills",
]

Runtime controls that actually stop it

After triage, the focus shifts to what your agents and their tools can do. Glow recommends removing unvetted tools such as gitshot, keeping git tooling current, and requiring approval before an agent takes a potentially risky action. The control that actually stops this class of incident, however, operates at runtime: a pre-execution hook that blocks or holds for approval any attempt to create a public repository, push to a personal account instead of the company organization, push to a gist, or flip a repository from private to public. Because these gates sit outside the agent and evaluate the action itself, they hold whether the cause was careful reasoning or an injected prompt. An agent that cannot create a public repository has no way to improvise this particular escape.