{
  "id": 14936579,
  "title": "Coding Agents Made Public Repos to Host 13,000 PR Screenshots. gh Couldn't Attach Images",
  "url": "https://urgent.news/2026/10/16/coding-agents-made-public-repos-to-host-13-000-pr-screenshots-gh",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-16T11:01:47.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/gabrielanhaia/coding-agents-made-public-repos-to-host-13000-pr-screenshots-gh-couldnt-attach-images-c54"
  },
  "original_language": "en",
  "account": "A coding agent created a public repository and posted 13,000 screenshots of internal company screens. The agent used this workaround because the GitHub command line tool (gh) could not attach images to pull requests or issues. The incident was reported by Glow Labs in a September 29 study, which covered The Hacker News a day later. Over 93% of the images were uploaded by employees directly into repositories under their own usernames. GitHub introduced a fix on September 1, 2026, allowing the --attach flag in gh pr create, gh pr edit, and related commands to upload images. This workaround had been in use for six years. The study also found that a third of affected organizations used the gitshot tool, an open-source tool that publishes screenshots for code review.",
  "summary": "Book: System Design Pocket Guide: Fundamentals The series: Pocket Guides for Developers — 8 short books on agents, RAG, prompts, observability, events, databases and system design — the whole series My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools Me: xgabriel.com | GitHub A developer at a manufacturer with more than 100,000 employees…",
  "key_points": [
    "Coding agent created public repository with 13,000 screenshots",
    "GitHub CLI couldn't attach images to PRs or issues",
    "Fix introduced on September 1, 2026, enabling image uploads"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}