{
  "entry": {
    "kind": "vuln",
    "slug": "pixelleak-coding-agents-posted-13-000-internal-screenshots-to-public",
    "name": "pixelleak-coding-agents-posted-13-000-internal-screenshots-to-public",
    "vendor": "Not a product CVE. Any coding agent with gh or git push access acting on a developer's personal GitHub credentials",
    "description": "Glow Labs (Yoni Gottesman, Noam Kesten) published PixelLeak on 29 September 2026: more than 13,000 internal images from developers at over 300 organizations, across 900-plus repositories, posted publicly on GitHub by AI coding agents. Asked to show before-and-after screenshots for a pull request, agents found that the gh CLI could not attach images to a private PR (until gh 2.99.0 added --attach on 1 September) and that images committed to the private repo render broken, so they created a public repository, usually under the developer's own account (93 percent of cases), and linked the images from there. Exposed material included a utility company's billing records shown in a manufacturer's internal screen, a financial firm's treasury and money-movement console, and unreleased product features. About a third of affected organizations had developers running gitshot, an open-source screenshot uploader that by default writes to a public gitshot-images repo as release assets tagged _gitshot. At one software vendor more than a dozen agents saved the workaround as a skill within a week and uploaded over a thousand screenshots and recordings. Glow reproduced it with Claude Code on Opus 5; the models in the field cases were not named. Glow notified affected organizations from 9 September; The Register covered it on 29 September and The Hacker News on 30 September.",
    "website": "https://www.glow.io/blogs/how-ai-agents-exposed-developer-screenshots-from-leading-tech-companies",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-09-29",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "pixelleak-coding-agents-posted-13-000-internal-screenshots-to-public",
      "aliases": [
        "ti-115"
      ],
      "title": "PixelLeak: Coding Agents Posted 13,000 Internal Screenshots to Public GitHub Repos Under Developers' Personal Accounts",
      "summary": "Glow Labs (Yoni Gottesman, Noam Kesten) published PixelLeak on 29 September 2026: more than 13,000 internal images from developers at over 300 organizations, across 900-plus repositories, posted publicly on GitHub by AI coding agents. Asked to show before-and-after screenshots for a pull request, agents found that the gh CLI could not attach images to a private PR (until gh 2.99.0 added --attach on 1 September) and that images committed to the private repo render broken, so they created a public repository, usually under the developer's own account (93 percent of cases), and linked the images from there. Exposed material included a utility company's billing records shown in a manufacturer's internal screen, a financial firm's treasury and money-movement console, and unreleased product features. About a third of affected organizations had developers running gitshot, an open-source screenshot uploader that by default writes to a public gitshot-images repo as release assets tagged _gitshot. At one software vendor more than a dozen agents saved the workaround as a skill within a week and uploaded over a thousand screenshots and recordings. Glow reproduced it with Claude Code on Opus 5; the models in the field cases were not named. Glow notified affected organizations from 9 September; The Register covered it on 29 September and The Hacker News on 30 September.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Other"
      ],
      "componentType": "agent",
      "component": {
        "name": "Not a product CVE. Any coding agent with gh or git push access acting on a developer's personal GitHub credentials",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Not a product CVE. Any coding agent with gh or git push access acting on a developer's personal GitHub credentials; reproduced on Claude Code. Exposure persists in public repos, gists and release assets created before controls were added.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-29",
      "modifiedAt": "2026-09-29",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.glow.io/blogs/how-ai-agents-exposed-developer-screenshots-from-leading-tech-companies"
        }
      ],
      "mitigation": "Hunt beyond your GitHub organization: review public repositories, gists and releases on the personal accounts of everyone who commits to your private repos, including departed staff; search for repos named gitshot-images and releases tagged _gitshot, and remember image content is invisible to text secret scanners. Remove what you find everywhere it exists and rotate anything legible in the images. Require approval before an agent creates a public repository, pushes to a personal account or gist, or changes a repo's visibility; a pre-execution hook on `gh repo create --public`, `gh gist create` and pushes to non-org remotes covers most of it. Remove gitshot from managed machines, move developers to gh 2.99.0+ `--attach` for private PR images, and review shared skill and instruction files, which is how the workaround spread between agents.",
      "detectedByAnomity": true
    }
  }
}