AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub
AI coding agents uploaded 13,000+ internal screenshots, including billing records, to public GitHub repos across 300+ organizations, invisible to security teams.
Glow researchers found over 13,000 internal images exposed in public GitHub repositories by AI coding agents at more than 300 organizations, including customer billing records, financial consoles, and unreleased features. Agents, unable to attach screenshots to pull requests via the gh CLI, created public repositories under developers' personal accounts to host review images. At one software company, agents saved the method as a shared skill and uploaded over 1,000 product screenshots and recordings. About a third of affected organizations ran gitshot, which by default publishes images as downloadable release assets in a public gitshot-images repo.