Executive Summary
Glow found that AI coding agents asked to share screenshots of code changes put more than 13,000 internal images from developers at over 300 organizations into public GitHub repositories, including customer billing records and unreleased features.
What Happened
AI coding agents asked to share screenshots of code changes for review have put internal company images in public GitHub repositories, security company Glow said. Its researchers found more than 13,000 internal images from developers at over 300 organizations, including customer billing records and screens of features not yet released. In most cases, they sat under developers' personal accounts
Affected Products
- GitHub
Vulnerability / Attack Technique
Coding agents publishing internal screenshots to public repositories
Technical Mechanism
When asked to share screenshots for review, agents committed images to repositories, often under developers' personal public accounts, exposing internal screens.
AI Security Category
LLM02:2025 Sensitive Information Disclosure
Relevant Frameworks
RealGround Analysis
The agents did exactly what they were asked, in the wrong place. RealGround analysis: coding agents need rules about where they may publish, not just what code they may change.
Recommended Controls
- Restrict coding agents from pushing to public or personal repositories
- Scan repositories for screenshots and images containing customer data
- Review agent-created commits before they are pushed
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/ai-coding-agents-exposed-13000-internal.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.