AI agents leak corporate screenshots, cars phone home: the data behind the sports tech boom

Researchers affiliated with Glow Security, a startup backed by Sequoia and Greenoaks, found the screenshots across 343 companies. They call the discovery PixelLeak. The Register reported the findings on 29 September. The exposures included a Fortune 500 travel company, finance firms, cloud providers and foundation model companies.

Why does this matter to anyone building sports analytics products? Because the same agentic tooling that lets a small team ship a performance dashboard in a week is the tooling in the leak. According to The Register, developers ask an AI agent to show before-and-after interface images. GitHub has no API for uploading images to pull requests, so the agents post them to public repos instead. One manufacturer with more than 100,000 employees only learned about the posts when Glow told its security team.

Glow said about a third of the exposures came through gitshot, an open source screenshot tool whose own privacy notice warns that uploaded images are public by default. "The biggest risk factor that we're seeing is in legitimate AI being used by developers, but then doing things that should not be done," Glow co-founder and CTO Omer Singer told The Register.

The data pipes keep growing

The broader data economy that sports technology feeds on is not shrinking. Bain and Company said on 29 September that the AI industry must generate $6 trillion in annual revenue by 2031 to justify data centre capital spending, according to The National. The consultancy projects annual AI infrastructure spending could reach $1.5 trillion by 2031, and says data centre sizes and costs are doubling roughly every 12 to 16 months. That buildout is being pitched to provinces and states.

CBC News reported on 29 September that Newfoundland and Labrador's energy minister, Lloyd Parrott, said the province's door is "open for business" after companies approached it about AI data centres. TechNL CEO Andrea King told CBC that Labrador has low-carbon hydro power, cold weather and land, but that opportunity cost still has to be weighed. Consumer data flows are under fresh scrutiny too.

A Northeastern University study with Consumer Reports, published this week and covered by The Verge and Consumer Reports on 29 September, tested 21 late-model vehicles from 19 brands plus 30 companion apps. Every vehicle transmitted data to at least one third-party domain over Wi-Fi, and over half contacted advertising, tracking or analytics domains. Seven apps sent VINs, phone numbers and precise locations to ad networks.

"It does not appear that a customer can buy a new car that does not track you," said study co-author Sarah Elizabeth Gillespie, in Consumer Reports.

None of this is hypothetical for teams that ship wearables, ticketing systems or fan apps. The Pentagon's Defense Manpower Data Center breach exposed records of more than 3 million people, including Social Security numbers stored without encryption, according to Beinsure on 29 September. Datadog, which processes more than 100 trillion events per day, described in an Antithesis blog post on 29 September how it used fault injection to rebuild its intake pipeline without losing data. The lesson for sports analytics is unglamorous. Every dataset you collect is a dataset you must protect, back up and eventually delete. BMLL, writing on Polars' blog on 29 September, said it processes over 1.5 TB of market microstructure data in just over 3 minutes on a single machine, a pitch that will sound familiar to anyone benchmarking athlete tracking workloads. The tooling is fast. The governance is not.