At a manufacturer with more than 100,000 employees, an AI coding agent asked to verify a billing-screen fix posted the proof, a utility company’s billing records included, to a public repository under the developer’s personal GitHub account. Glow Labs disclosed on September 29 that the same workaround put more than 13,000 internal images from over 300 organizations on public GitHub, in 93 percent of cases under personal usernames your audit log never sees. If your developers run coding agents with the GitHub CLI logged in, run the sweep below this week and take public publishing away from the identities those agents use.
What happened
Glow calls the research PixelLeak. It spans more than 900 repositories at over 300 organizations, among them one of the world’s largest tech companies, a frontier AI lab and a Fortune 500 travel company. A day later, The Hacker News counted about 130 public repositories created by one upload utility alone.
Two caveats deserve equal billing. Glow has not published how it found or counted the images, or whether anyone besides its researchers downloaded them, and it sells software it says can stop agent actions like these. We still treat it as credible, because the mechanism reproduces from public documentation and code, and the timeline shows how.
- March 25, 2026: the gitshot upload tool ships its first release.
- Early July 2026: at one software vendor, agents start posting review screenshots publicly, and within a week more than a dozen have saved the method as a skill.
- September 1, 2026:
ghv2.99.0 adds--attach, the first sanctioned command-line path for images. - September 9 and 29, 2026: Glow notifies affected organizations, then publishes.
How AI coding agents ended up publishing to public repos
None of this needed a malicious prompt. Until September 1, gh could only write text, a gap open since 2020, and images committed to a private repository render broken for reviewers, so an agent asked to show a before-and-after had no clean way to do it. In Glow’s lab reproduction with Claude Code and an Opus 5 model, the agent’s recorded reasoning noted that GitHub’s image proxy fetches anonymously, concluded the images had to live elsewhere, and created a public repository for two screenshots. In the wild, the agents ran on several models Glow has not named.
We read that reasoning as the whole lesson. The agent optimized for its goal, under a constraint it could not solve, with the one identity it held, and that identity could publish to the open internet without asking anyone. The manufacturer’s billing screen was the same move with real customer data in the frame.
Then the workaround spread. At the software vendor, skills (the instruction files an agent loads and follows) turned one agent’s improvisation into a team habit that leaked more than 1,000 screenshots and recordings plus summaries of unreleased features. About a third of affected organizations had developers running gitshot, an open-source tool built for the same gap. With gh logged in, its release backend creates a public <user>/gitshot-images repository, uploads images as release assets under a _gitshot tag, and deliberately refuses private or organization-owned repositories. Its README warns the repository is public. Agents used it anyway, which at one financial services firm put screenshots of a treasury and settlement console in public.
Release assets are the detail to hold on to, because they do not appear in a repository’s file list and anyone can download them without logging in.
Are you affected
Exposure depends less on which agent you run than on which identity it holds, so we triage by setup rather than by product.
| Setup on the developer endpoint | Exposure |
|---|---|
gh logged in as a regular GitHub.com account that can own public repositories |
Highest, the pattern behind the 93 percent |
gh older than v2.99.0 |
Higher, with no sanctioned attach path to use |
| GitHub Enterprise Server | Open, because --attach is not supported there |
| Enterprise Managed Users | Lower, since managed users can only own private repositories and cannot create gists |
gitshot installed as a CLI, gh extension or agent skill |
Assume exposure until the sweep says otherwise |
That protection belongs to the managed account, so a developer who also logs gh into a personal account on the same laptop is back in the first row. It is shadow AI in its most literal form.
How to find leaked screenshots in your GitHub footprint
Auditing your own organization will not find these, since the repositories live in personal namespaces. Glow’s advice is to start from the people who commit to your private repositories, including those who have left, plus every current member. The sweep below needs nothing but gh api.
Data source: GitHub REST API through an authenticated gh session with read access to the organization
ORG=your-org # your organization login
{
gh api --paginate "orgs/$ORG/members" --jq '.[].login'
gh api --paginate "orgs/$ORG/repos?type=private" --jq '.[].full_name' |
while read -r repo; do
gh api --paginate "repos/$repo/contributors" --jq '.[].login'
done
} | sort -u > people.txt
while read -r user; do
gh api --paginate "users/$user/repos?type=owner" --jq '.[].full_name' |
while read -r repo; do
echo "$repo release_assets=$(gh api "repos/$repo/releases" --jq '[.[].assets[]] | length')"
done
gh api --paginate "users/$user/gists" --jq '.[] | select(.public) | .html_url'
done < people.txt
gh search repos gitshot-images --match name --limit 200 --json fullName --jq '.[].fullName'The output is a review queue, not a verdict. Scanners read text, not pixels, so a person has to open the images, and we would start with any _gitshot release and any repository that holds release assets but little code. Expect API rate limits in large organizations. When something turns up, follow Glow’s order of operations: remove it everywhere, ask anyone holding a copy to delete it, and rotate whatever is legible in the pictures.
How to detect AI coding agents publishing to public GitHub
The sweep finds what already leaked. For what happens next, the useful artifact lives on the endpoint, because the agent ran on the developer’s laptop and the GitHub side landed in a namespace your organization does not log. Every path in this story ends in a gh process with a telling command line, gitshot included, since it shells out to gh repo create and gh release upload from Node.
Data source: process creation events with full command line from your EDR or Sysmon (Event ID 1 on Windows, Sysmon for Linux) on developer endpoints, and on macOS an EDR that records exec events with arguments
title: GitHub CLI Publishing Content Publicly From a Developer Endpoint
id: 6c1f2a9e-4b7d-4e38-9a51-0d3e8f2b7c64
status: experimental
description: Detects GitHub CLI calls that create a public repository, switch a repository to public or create a public gist, plus any use of the gitshot upload tool. AI coding agents used these paths to host pull request screenshots outside private repositories (Glow PixelLeak, September 2026).
references:
- https://www.glow.io/blogs/how-ai-agents-exposed-developer-screenshots-from-leading-tech-companies
- https://github.com/vipulgupta2048/gitshot/blob/8c24a699677cd81f2aac6f4e261a43e50f370d60/src/release.ts
author: MarkCyber Research
date: 2026-09-30
tags:
- attack.exfiltration
- attack.t1567.001
logsource:
category: process_creation
detection:
gh_cli:
Image|endswith:
- '/gh'
- '\gh.exe'
publish_repo_create:
CommandLine|contains|all:
- 'repo create'
- '--public'
publish_visibility_change:
CommandLine|contains|all:
- 'repo edit'
- '--visibility public'
publish_visibility_change_equals:
CommandLine|contains|all:
- 'repo edit'
- '--visibility=public'
publish_public_gist:
CommandLine|contains|all:
- 'gist create'
- '--public'
publish_public_gist_short:
CommandLine|contains|all:
- 'gist create'
- ' -p'
gitshot:
CommandLine|contains: 'gitshot'
condition: (gh_cli and 1 of publish_*) or gitshot
falsepositives:
- Maintainers who publish open source repositories or gists from managed workstations
- Onboarding scripts that create public dotfiles repositories
level: mediumThe rule maps to T1567.001, Exfiltration to Code Repository. Allowlist known open source maintainers by user, but keep any hit whose parent process is a coding agent in the review queue. It cannot see a git push into a public repository that already exists, direct REST calls through gh api or curl, the web UI, or agents running in cloud sandboxes instead of on your endpoints. Hunt back as far as retention allows, with March 25, 2026 as the floor for gitshot cases and early July for the skill-driven spread.
Mitigation: AI coding agent security controls that hold
We rank controls by what an agent cannot talk its way around, and identity comes first. Where you can, move developers to Enterprise Managed Users, because an account that cannot own a public repository or create a gist removes the destination instead of policing the route. It applies treating every agent as an identity to the laptop’s most mundane credential.
Second, close the gap that caused the improvisation. Update gh to v2.99.0 or later and tell agents, in the instruction files they load, to use --attach on gh pr create or gh pr comment for review images. Files attached in a private repository can be viewed only by people with access to it. The flag needs write access and does not work on Enterprise Server, so GHES shops need an approved internal image host.
Third, move agent permissions into managed policy and put public repository creation, visibility changes, gists and pushes to personal namespaces behind approval, as Glow recommends. Claude Code managed settings, which user and project settings cannot override, and GitHub Copilot’s enterprise managed permissions are two examples of the mechanism, yet Claude Code’s own documentation says a Bash rule matches the command text the agent writes and is not a security boundary around the program. Gitshot shows why, because the agent may type only npx gitshot while gh repo create --public runs one process further down, which is why identity and endpoint controls sit underneath this layer.
Finally, read the skills. The vendor’s leak scaled because a workaround became a shared skill, so review skill and instruction files like code and remove gitshot from managed endpoints. Skill review is part of our LLM and agent security work, and it is usually the layer nobody has opened.
Bottom line
Run the sweep across members and past contributors this week, and have a person review what it finds. Deploy the Sigma rule to developer endpoints, update gh so agents have a private attach path, and take public publishing away from the identities your agents use. The manufacturer’s billing screen went public because the agent could publish it, so make sure yours cannot.