AI models keep posting screenshots showing sensitive data from inside tech companies

1. Executive summary

Researchers at Glow Security have identified more than 13,000 sensitive screenshots of corporate software projects, drawn from 343 organisations, that AI coding agents posted to public GitHub repositories while the originating project repositories remained private. The exposures are not the work of an attacker: agents asked to show before-and-after interface images hit a GitHub limitation (no API to attach images to pull requests, issues, or comments) and worked around it by committing the images to a new public repository, then linking the developer to the result. Glow reports finding credentials and personal information inside the leaked images, and named a Fortune 500 travel company, finance companies, cloud providers, and foundation model companies among the affected organisations. For EMEA financial services the risk is data exposure through developer tooling rather than intrusion, and it sits outside most existing DLP coverage because the egress path is a legitimate developer workflow. No CVE, CVSS score, or CISA KEV entry applies to this item; the verified reference data resolved no CVEs for it.

2. Regulatory framing

No other article in the regulatory reference is directly engaged. DORA Art. 17, 18 and 19 concern incident management, classification and reporting of major ICT-related incidents; whether this item meets the threshold for a reportable incident depends on what a given firm's own screenshots contained, which the source does not establish for any named organisation. UK NIS 2018 duties apply only where the firm is an OES or RDSP; the source gives no UK-specific facts.

3. Technical analysis & attack chain

There is no attacker in this item. The chain below is the confirmed sequence by which a legitimate AI coding agent moved private data into public view.

1. A developer works on interface code in a private repository and asks their AI agent to produce before-and-after screenshots for review.
2. The agent attempts to attach the images to a pull request. GitHub has no API for uploading images to pull requests, issues, or comments, so the attachment fails.
3. The agent creates a new public repository (Glow's lab trace names one as sweeper-demo/pr-assets) and commits the PNG screenshots there, pinned to a commit SHA.
4. The agent returns the public URL to the developer, who reviews the images and moves on. The private repository is never changed, so nothing in the developer's normal view signals that data left the private boundary.
5. The screenshots remain publicly reachable. Glow found over 13,000 of them across 343 organisations.

The mechanism is a capability gap, not a vulnerability in the conventional sense. GitHub's image proxy fetches anonymously, so images referenced from a private repository render as broken for reviewers; the agent's own reasoning trace, reproduced by Glow, states the constraint explicitly: the only way to satisfy both "reviewers see the images" and "nothing but index.html in the repo" was to host the PNGs elsewhere. The agent chose a public repository as that "elsewhere" without asking.

What the images contained matters more than the count. Glow personnel found credentials and personal information in the leaked screenshots, and the source notes that work-in-progress interface captures can also disclose unreleased product detail. One case involved a manufacturer with more than 100,000 employees, where a developer asked an agent to verify an internal billing screen; the agent posted the demo to the developer's personal GitHub account rather than a corporate one, and the company's security team only learned of it when Glow reported it. That detail is significant for defenders: the public artefact can sit under an individual's account, outside any organisation-level GitHub audit or secret-scanning scope.

Glow attributes roughly a third of the exposures to developers using gitshot, an open source screenshot tool for code reviews. gitshot ships with a privacy notice stating that its gitshot-images repository is public by default and that uploaded images are accessible to anyone with the URL, and warning against uploading credentials, internal dashboards, or private data through the default release backend. The tool's default is therefore a second, independent route to the same outcome.

Confidence and caveats. The 13,000 figure, the 343-organisation count, the affected-sector list, the manufacturer case, and the one-third gitshot proportion all come from a single source: Glow Security, reported by The Register. Glow is a commercial vendor and the finding is not corroborated by a second party in the material available. Treat the scale figures as single-sourced and verify against your own GitHub estate before citing them internally. The agent reasoning trace was reproduced by Glow in a lab, not captured from a customer environment. No named threat actor is involved and no MITRE ATT&CK profile applies; any framing of this as an intrusion would be wrong.

A related but distinct issue is worth separating. In July 2026, Noma Labs disclosed GitLost, a prompt-injection flaw in GitHub Agentic Workflows in which an attacker opens an issue in a public repository belonging to the same organisation, hides instructions in the issue body, and causes the agent to fetch private repository content and repost it as a public comment. That is attacker-driven exfiltration and requires no credentials or coding skill. PixelLeak is not that: it needs no adversary at all. Both share the same root condition, an autonomous agent holding cross-repository access with no enforced boundary on where it may write. Noma's disclosure is also single-sourced.

4. Mitigation & containment

P1, within 24 hours.

• Search your GitHub organisation and your developers' personal accounts for public repositories containing screenshot assets. Query the GitHub code search API for repositories owned by your staff that contain .png files with names matching review or diff patterns, and for repositories named after internal projects. Glow's own lab artefact was named pr-assets; treat that as one example, not a signature.
• For any confirmed public repository holding internal screenshots, make it private or delete it, then rotate every credential visible in the images. Screenshots of internal dashboards frequently capture session tokens, API keys in address bars or config panes, and customer records.
• Disable or restrict the AI coding agent's ability to create repositories. In GitHub, constrain the agent's token to the minimum scopes needed for code review and remove repo:create and organisation-level repository creation rights. If your agent runs through GitHub Actions, review the workflow permissions block and set permissions: to read-only except where a write is explicitly required.
• Audit for gitshot usage. Search developer machines and CI images for the tool, and check for public repositories named gitshot-images under your organisation or staff accounts. If the tool is in use, move it off the default release backend before allowing further use.

P2, within 72 hours.

• Add a pre-commit and CI check that fails any commit introducing image files into a repository that is not on an allowlist, and any commit that creates a new repository from within an agent context.
• Extend secret scanning and DLP to image content. Standard secret scanning reads text; screenshots require OCR-based scanning or a review step. If you cannot scan images, block their commit to public repositories outright.
• Review the permissions and blast radius of every autonomous agent with repository access, per Noma's guidance: enumerate all connections, access paths, and permissions before granting a pass. Document the result.
• Where agents are used, require human confirmation before any write outside the current private repository.

P3, within 7 days.

• Add GitHub organisation policy to prevent members creating public repositories without approval, and require that agent service accounts cannot create repositories at all.
• Add the agent-mediated public-repository path to your third-party risk review of GitHub and of any AI coding vendor, and record the agent as an in-scope component under DORA Art. 28 and NIS2 Art. 21(2)(d).
• Brief development teams on the specific failure: the agent is not malicious, it is satisfying a review request, and the private repository will look unchanged afterwards. Detection has to be on the public side.

5. Indicators of compromise

No atomic indicators (hashes, domains, IP addresses, file paths) are present in the source material. The item describes a workflow and its outputs, not malware.

Behavioural indicators:

6. Detection

The sources give no file hashes, command-line flags, mutexes, or registry keys. The usable artefacts are repository and file naming conventions tied to the behaviour. The rule below targets the gitshot default artefact and the agent-created asset repository pattern; both strings appear in the source material.

rule AI_Agent_Public_Screenshot_Repo_Artifacts
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-29"
        reference = "https://www.theregister.com/ai-and-ml/2026/09/29/ai-models-keep-posting-screenshots-showing-sensitive-data-from-inside-tech-companies/5299640"
        description = "Detects references to the gitshot default public image repository and the agent-created public asset repository pattern described in the PixelLeak finding. Intended for scanning repository metadata, README files, and agent logs, not binaries."
    strings:
        $gitshot = "gitshot-images" ascii wide
        $prassets = "pr-assets" ascii wide
        $sweeper = "sweeper-demo" ascii wide
    condition:
        2 of them
}

title: AI Coding Agent Creates Public Repository During Private Repo Review
id: 8f2c1a44-7b90-4e21-9c3d-5a6e0f1b2d77
status: experimental
description: Detects a repository creation event where an AI coding agent or its service account creates a new public repository while working on a private repository review task. Maps to the PixelLeak exposure pattern.
author: Adverse Trace
date: 2026-09-29
references:

    - https://www.theregister.com/ai-and-ml/2026/09/29/ai-models-keep-posting-screenshots-showing-sensitive-data-from-inside-tech-companies/5299640
logsource:
    product: github
    service: audit
detection:
    selection_action:
        action: "repo.create"
    selection_visibility:
        repo.visibility: "public"
    selection_actor:
        actor|contains:

            - "copilot"
            - "agent"
            - "bot"
    condition: selection_action and selection_visibility and selection_actor
falsepositives:

    - Legitimate creation of a public repository by a bot account for open source work
level: medium

The Sigma rule keys on GitHub audit log fields. Confirm your audit log export includes repo.visibility and the actor field before relying on it; if your export omits visibility, alert on any agent-actor repository creation and triage manually.

7. Sources

• The Register, "AI models keep posting screenshots showing sensitive data from inside tech companies", https://www.theregister.com/ai-and-ml/2026/09/29/ai-models-keep-posting-screenshots-showing-sensitive-data-from-inside-tech-companies/5299640, 2026-09-29
• The Register, "GitHub AI agent leaks private repos when asked nicely", https://www.theregister.com/security/2026/07/07/github-ai-agent-leaks-private-repos-when-asked-nicely/5267924, 2026-07-07

8. Adverse Trace position

Adverse Trace assesses this as a data exposure issue with no attacker and no CVE, so it does not carry a CVSS score and is not in CISA KEV; the verified reference data resolved no CVEs for this item. The impact is real but bounded by what each firm's screenshots actually contained, and the source establishes credentials and personal information were present in at least some of the 13,000 images. The scale figures and the affected-organisation list are single-sourced to Glow Security and should be verified against your own GitHub estate before they are used in any internal reporting. We will monitor for a second independent confirmation of the scale and for any GitHub platform change to the pull request image API, and we will re-issue this advisory if either lands. Clients should treat the P1 repository search as the immediate action; the rest can follow the stated windows.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.