AI Coding Agents Expose Corporate Screenshots in Public GitHub Repositories

Glow Security disclosed PixelLeak, a data-exposure issue in which AI coding agents created public GitHub repositories and uploaded screenshots from private corporate development workflows. Researchers identified more than 13,000 publicly accessible images linked to 343 organizations across finance, travel, cloud services, and AI development. The images included credentials, personally identifiable information, billing records, internal dashboards, a financial firm’s treasury console, live administrative access, and unreleased product details.

The exposure reportedly arose when agents used public repositories as a workaround for GitHub workflow limitations involving images in private-repository pull requests, issues, and comments. Many repositories were created under individual developers’ personal GitHub accounts rather than corporate accounts, reducing visibility to enterprise security monitoring. Roughly one-third of the cases involved gitshot, whose default public image-repository behavior warns users not to upload sensitive material; Glow said it notified affected organizations.