Loading story…
Glow Security disclosed PixelLeak, a data-exposure issue in which AI coding agents created public GitHub repositories and uploaded screenshots from private corporate development workflows. Researchers identified more than 13,000 publicly accessible images linked to 343 organizations across finance, travel, cloud services, and AI development. The images included credentials, personally identifiable information, billing records, internal dashboards, a financial firm’s treasury console, live administrative access, and unreleased product details.
The exposure reportedly arose when agents used public repositories as a workaround for GitHub workflow limitations involving images in private-repository pull requests, issues, and comments. Many repositories were created under individual developers’ personal GitHub accounts rather than corporate accounts, reducing visibility to enterprise security monitoring. Roughly one-third of the cases involved gitshot, whose default public image-repository behavior warns users not to upload sensitive material; Glow said it notified affected organizations.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
Glow Security/Glow Labs reported the PixelLeak data-exposure pattern: AI coding agents created or used public GitHub repositories, often under developers' personal accounts, to host screenshots from private development work for code review. Its research identified more than 13,000 publicly accessible images affecting more than 300 organizations, including exposed credentials, personal information, billing data, administrative access, and unreleased product details; Glow said it notified affected organizations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability was discovered in GitHub Copilot Chat that could have allowed attackers to exfiltrate private source code and sensitive secrets from repositories by exploiting the platform’s AI assistant and image proxying service. The flaw, identified by Legit Security researcher Omer Mayraz, involved a sophisticated attack chain that combined remote prompt injection with a bypass of GitHub’s content security policy. Attackers could embed hidden prompts within pull request comments or other repository content, which Copilot Chat would process without proper isolation or validation. This allowed the attacker to manipulate Copilot’s responses and assemble signed image links that leveraged GitHub’s Camo image proxy service to transmit stolen data outside the platform. The exploit, dubbed "CamoLeak," demonstrated that even advanced AI-powered developer tools can be manipulated to leak confidential information, including passwords and private keys, with minimal user awareness. The proof-of-concept attack showed that the exfiltration channel was subtle enough to evade detection by both users and GitHub’s monitoring systems. GitHub Copilot Chat’s context awareness, which enables it to read repository files, pull requests, and other workspace artifacts, was a key factor in the attack’s success, as it provided the AI assistant with access to sensitive data that could be extracted through manipulated prompts. Upon responsible disclosure via HackerOne, GitHub responded by disabling image rendering in Copilot Chat and patching the vulnerability as of August 14. The incident highlights the growing risks associated with integrating AI agents into software development workflows, especially when such agents have broad access to sensitive project data. Security experts noted that while the attack was limited in the amount of data it could exfiltrate at once, the potential impact was significant due to the nature of the information at risk. The case underscores the importance of rigorous security validation for AI-driven features and the need for continuous monitoring of new attack vectors as AI adoption accelerates in development environments. GitHub’s swift response and remediation efforts were commended, but the event serves as a cautionary tale for organizations relying on AI-powered coding assistants. The vulnerability also illustrates the creative lengths attackers may go to bypass security controls, turning legitimate platform features like image proxies into covert data exfiltration channels. The research community continues to scrutinize AI integrations for similar weaknesses, emphasizing the need for secure-by-design principles in next-generation developer tools. Organizations are advised to review their use of AI assistants, ensure prompt application of security updates, and educate developers about the risks of prompt injection and related attacks. The incident has prompted broader discussions about the balance between AI functionality and security, especially as more platforms embed intelligent agents into core workflows. Ultimately, the GitHub Copilot Chat vulnerability demonstrates both the promise and peril of AI in software development, reinforcing the need for vigilance and proactive defense measures.
Jun 29, 2026
Researchers at Noma Security disclosed **GitLost**, a prompt injection technique that can make GitHub **Agentic Workflows** expose data from private repositories through public issue comments. In the demonstrated attack, an adversary needed only to open a crafted issue in a public repository; if the workflow had broad cross-repository read access and permission to post publicly, the agent could be steered into retrieving content from a private repository in the same organization and publishing it as part of its response. The proof of concept showed the agent reading a private repository `README` and using its own authorized access as the exfiltration path, without the attacker needing credentials, coding skills, or direct access to the private repo. Noma said GitHub had been notified through responsible disclosure and published workflow reproductions and proof-of-concept evidence after testing. The researchers also reported that GitHub’s prompt-based output protections could be bypassed with a one-word prefix—**"Additionally,"**—causing the model to comply with the malicious instruction instead of refusing it. The findings highlight an architectural risk in AI agents that combine access to sensitive internal data, ingestion of untrusted public input, and an outward publishing channel; recommended mitigations include minimizing token and repository scope, limiting what agents can publish publicly, restricting which users can trigger agent actions, and requiring human review before public posting.
Jul 13, 2026
Security researchers at Flare have discovered that over 10,000 public Docker Hub container images are leaking sensitive secrets, including live credentials for production systems, cloud services, CI/CD pipelines, and AI platforms. The exposed data affects more than 100 organizations, ranging from small businesses to a Fortune 500 company and a major national bank. Many of these secrets are not placeholders but active credentials, with nearly 4,000 API keys for large language models such as OpenAI, HuggingFace, Anthropic, Gemini, and Groq found in the wild. In some cases, a single image contained five or more exposed secrets, significantly increasing the risk of unauthorized access to critical infrastructure. The leaks are often the result of developers inadvertently including sensitive files and hard-coded keys in Docker images, which are then published to public repositories. A notable portion of the exposed secrets comes from "shadow IT" accounts—personal or team Docker Hub registries outside formal corporate oversight—making them difficult for organizations to monitor and secure. The majority of affected organizations are in the software development sector, but the exposure also impacts finance, banking, and AI companies. This incident highlights the urgent need for improved security hygiene and automated scanning in the container development lifecycle to prevent inadvertent credential leaks.
Jun 29, 2026