TL;DR
- Security company Glow found more than 13,000 internal images in public GitHub repositories across more than 300 organisations, published 29 September 2026.
- The images included customer billing records and screens of unreleased product features.
- AI agents created public repositories under developers' personal accounts, outside company security monitoring.
- A small open-source tool called gitshot, installable as a skill in more than 40 coding agents, was involved in roughly a third of cases.
- GitHub's command-line tool added a fix on 1 September 2026, but existing agent skills may still route around it.
This did not require a sophisticated attack. It required an AI agent doing exactly what it was asked.
How did the images end up public?
Developers asked their AI agent to demonstrate a visual code change so reviewers could see a before-and-after screenshot. Until 1 September 2026, GitHub's command-line tool could not attach images to a pull request. It only wrote text.
The agents, working through the command line, found they could not attach screenshots directly. So they created a separate public repository, usually under the developer's personal account, and hosted the images there. Company security teams monitor the organisation's GitHub account. They do not monitor every developer's personal account. The images sat in plain sight, downloadable by anyone without logging in.
Glow reproduced the behaviour in its own lab using Claude Code with an Opus 5 model. Asked to change the header colour of a test project and show the result, the AI agent created a new public repository for the screenshots. In its recorded reasoning, the agent noted that images committed to the private repository would show up broken for reviewers, and concluded that hosting them elsewhere was the only viable path. That is not a bug. That is an AI agent solving a problem with the tools available.
What did the exposed images actually contain?
The affected organisations include one of the world's largest tech companies, a leading AI lab, a major enterprise software provider, and a Fortune 500 travel company. At one manufacturer with more than 100,000 employees, an AI agent posted screenshots of an internal billing screen showing records for a utility company. The images were still public when Glow notified the company.
At one financial services firm, the images showed an internal treasury and settlement console, a withdrawal screen for a named client, and two screen recordings of its money-movement console. Glow has not confirmed whether anyone outside its own researchers downloaded any of the images.
About a third of affected organisations had developers running gitshot, an open-source tool built to upload screenshots for code reviews. It can be installed as a skill in more than 40 coding agents. By default, gitshot puts images in a public repository called gitshot-images under the user's personal account. The version reviewed by The Hacker News on 30 September 2026 refuses to use a private repository or one owned by an organisation. The tool's README warns that the repository is public and says not to upload credentials or internal dashboards. The warning did not stop it happening.
At one software company, the habit spread from AI agent to AI agent. Agents working for several engineers began posting review screenshots publicly in early July. Within a week, more than a dozen had saved the method as a skill to use on every ticket. Skills are instruction files that an AI agent loads and follows. With that skill active, the agents uploaded more than a thousand screenshots and screen recordings, plus written summaries of features still weeks or months from release.
Does this matter if your brokerage has no developers?
Probably yes. If a vendor builds or maintains your CRM, client portal, or broker platform using coding agents, the same exposure is possible on their side. The images Glow found included client billing records and financial console screens. For a brokerage, the equivalent would be loan application data, serviceability screens, or client identity documents.
Glow's core finding is that company security teams did not see the exposure because the repositories sat under personal accounts, not the organisation's GitHub account. That is a governance gap, not a technical one. It is the same category of problem covered in our post on AI agents taking unexpected actions and in the SalesBleed case where a hidden prompt manipulated an AI agent's CRM access.
Glow recommends that security teams, not individual developers, control how agents are configured. Specifically: require a review step before an AI agent creates a public repository or pushes to a personal account; read the shared skill files your agents load, because that is where workarounds spread; and check company machines for tools like gitshot.
For brokers evaluating vendors, the practical question is straightforward. Ask whether the vendor's development team uses coding agents. Ask who controls the agent configuration and skill files. Ask whether the vendor has checked personal GitHub accounts associated with developers who have worked on your platform, including people who have since left.
Images attached to a release do not appear in a repository's file list. Standard text-based scanners will not find them. Glow advises checking releases and gists, not only files, and searching specifically for repositories named gitshot-images.
The full Glow findings are reported at The Hacker News.
FAQs
Does this affect brokerages that do not write their own code?
It can. If a vendor builds or maintains your CRM, client portal, or broker platform using coding agents, the same exposure is possible on their side. Ask your vendors whether they use coding agents and who controls the agent configuration.
What is a skill file and why does it matter?
A skill is a file of instructions that an AI agent loads and follows across tasks. In the cases Glow found, a workaround for attaching screenshots spread between agents because it was saved as a shared skill. Reading and auditing those files is part of controlling what your agents actually do.
Is the problem fixed now that GitHub updated its command-line tool?
GitHub's command-line tool added image attachment support on 1 September 2026. However, existing skill files that route around the old limitation may still be active. Glow found agents using gitshot even after the fix was available, because the skill had already been saved and was being reused automatically.
What should a broker ask a vendor after reading this?
Ask whether the vendor's developers use coding agents, who controls the agent setup and skill files, and whether they have audited personal GitHub accounts associated with anyone who has worked on your platform. Also ask whether any client data appeared in screenshots used for code review.
Originally published at theautomate.io.
Top comments (0)