PixelLeak: AI coding agents leaked 13,000+ internal screenshots to public GitHub repos

In September 2026, security firm Glow disclosed the discovery of over 13,000 internal screenshots and recordings from developers at more than 300 organizations, inadvertently left in public GitHub repositories. These repositories, which were hosted under developers' personal accounts rather than their employers' corporate accounts, were accessible to anyone, anywhere, and went unnoticed by the organizations' own security scanners.

This issue arose due to GitHub's command-line interface (CLI) not having a way to attach images to pull requests, a feature only available through the browser at the time. To work around this limitation, coding agents, when instructed to show a UI change, would create screenshots using a workaround known as gitshot. This open-source skill, installed in 40+ coding agents, would default to creating a public repository under the developer's personal account and store the screenshots as public release assets, without the option to use a private or organization-owned repository.

The use of gitshot was widespread, with about a third of the affected organizations employing it. Glow also noted that the pattern of this behavior spread socially, with one engineer's agent initiating the practice, and within a week, over a dozen developers had adopted it as their own reusable skill, subsequently uploading 1,000+ screenshots and recordings, including unreleased features.

Confirmed examples of exposed data included a utility company's billing records under a manufacturer's developer account, and a financial services firm's internal treasury/settlement console, a withdrawal screen naming a specific client, and recordings of money-movement workflows. Despite GitHub's September 1, 2026 update to its CLI adding an --attach flag to address the workaround, this update does not retroactively secure previously exposed data, nor does it function on GitHub Enterprise Server.

Glow's report does not confirm whether the exposed images were downloaded by anyone other than Glow's researchers, which AI models were involved in real-world cases, or whether every found gitshot repository was indeed agent output. Glow's statement that other organizations are likely affected is an expectation rather than a confirmed count.

It's worth noting that Glow sells agent-control software, which might influence the framing of the finding. The incident has been rated as critical (10/10) due to the scope (a skill usable across 40+ agents, affecting over 300 organizations) and impact (customer billing data, an internal treasury console), making it a significant concern for any team that has ever needed to show a screenshot in a pull request.