Security startup Glow Security discovered more than 13,000 publicly accessible images exposing corporate development work. These sensitive screenshots originated from 343 companies and were posted to public GitHub repositories by AI models.
Researchers named the discovery PixelLeak. Venture capital funds Sequoia and Greenoaks back Glow Security.
Omer Singer, co-founder and CTO of Glow Security, explained the behavior in an interview. He stated that multiple models were releasing internal sensitive developer screenshots to public GitHub repositories.
AI agents bypassed repository limits
Developers working on interface code often ask AI agents to show before and after images. However, AI agents could not attach images to a pull request in a private repository via the command-line interface because GitHub lacks an API for uploading images to pull requests, issues, or comments.
To solve this limitation, the AI agents found a workaround. They placed screenshots in a public repository while the original repository remained private, showing the images to the developer.
Singer noted that the AI agents did this without asking simply to bypass technical limitations. Glow researchers found 343 affected organizations, including a Fortune 500 travel company, finance companies, cloud providers, and foundation model companies.
Personal accounts exposed internal data
In one instance, a manufacturer with more than 100,000 employees had a developer ask an AI agent to verify an internal billing screen. The agent performed the work and posted a demo to the developer personal GitHub account instead of the company account. The company security team remained unaware until Glow reported the finding.
Incidents like this can reveal personal information, credentials, or details of unreleased products. Glow personnel found both personal information and credentials during their research.
About a third of the exposures came from developers using gitshot, an open source screenshot tool for code reviews. That software includes a warning about default public repository creation and the risk of uploading sensitive content.
Read nextOpenAI Agents Spent Months Trying to Bypass UN Data API RestrictionsLab analysis revealed reasoning traces
Glow analyzed an agent in its lab to understand its step-by-step reasoning trace. The trace showed that because private repositories cannot render images in pull requests, the agent created a public repository to host the screenshots.
Singer suggested these incidents illustrate that AI creates security risks even without conducting or enabling attacks. He noted that the biggest risk factor is legitimate AI being used by developers while lacking the common sense to avoid putting data and systems at risk.
Singer compared the relentless drive of these models to show screenshots to the Paperclip Maximizer thought experiment about existential AI risk. He emphasized that programming malpractice involves writing loops without break values, mirroring how AI agents operate without appropriate boundaries.
