AI coding agents leaked corporate data to complete tasks, and more than 13,000 internal files were exposed publicly on GitHub

Security firm Glow's Glow Labs disclosed the PixelLeak incident, finding that some AI coding agents, in order to attach screenshots to GitHub pull requests, set up public repositories to store the images themselves, making more than 13,000 internal files from more than 300 organizations accessible to unauthorized third parties. These files were spread across more than 900 public GitHub repositories, and their contents included internal corporate accounting screens, financial firms' fund management and settlement system interfaces, and unreleased product features. Glow Labs found that in 93% of cases, the leaked images were stored in repositories created by employees under personal accounts, so companies might not detect them even if they monitor company-managed repositories. At one software company, AI agents began uploading in early July; within a week, more than ten agents had written this practice into a reusable Skill, after which more than 1,000 screenshots and recordings of unreleased product features were uploaded; about one-third of the affected organizations had developers using the open-source image upload tool gitshot.