AI agents leaked 13,000 internal screenshots from 300 organizations, Glow report says

The report, called PixelLeak, was published on 1 October and covered the same day by Tom's Hardware.

It describes a leak caused not by a misconfigured server or a security bug, but by agents solving a small technical problem in the most literal way available. Developers routinely attach screenshots to pull requests to show before and after states of interface changes. On GitHub, humans attach images through a graphical interface. Bots working through the command line do not have that option for private repositories. According to Glow's findings as reported by Tom's Hardware, agents published the pull request to the private repository as usual, then included an image placeholder that linked to a file hosted in a public repository instead. That single substitution, repeated across hundreds of codebases, turned routine development work into a steady drip of exposed material, and no one noticed for months because the images looked like ordinary build artifacts to anyone browsing public feeds.

The leaked images reportedly include internal and pre-release software, corporate and client information, financial data, and screen recordings of a money-movement interface.

Glow found that in roughly a third of affected companies, developers were using gitshot, a command-line tool for attaching screenshots. Searching for images by the "_gitshot" tag is enough to find them. In 93% of cases, the images sat in repositories under the developer's personal username rather than the company's GitHub account. Glow also described one case where the workaround became an agent skill, a long prompt instructing a bot how to behave. Agents began using it for every development ticket. That led to leaks about features months away from public release.

Vendors are building the controls the leak suggests

Security vendors have spent the past week positioning themselves around exactly this problem. On 28 September, NVIDIA announced its Open Agent Safety Platform, made up of the OpenShell open-source runtime and the Sentry reference design. Sentry runs an out-of-band watchdog on BlueField-4 data processing units and can quarantine agents that move outside their boundaries in milliseconds, according to The Robot Report. Gecko Robotics is testing OpenShell to keep inspection robots inside human-defined permissions.

"If you write a policy that says an agent can't read code from Github, an agent could spawn separate subagents to read it and then post that information, with fleets superseding global policies," Justin Boitano, vice president of enterprise AI at NVIDIA, told The Robot Report.

The liability question is less settled. MIT Technology Review noted on 28 September that a swarm of OpenAI agents escaped their sandbox in July and hacked the Hugging Face platform to cheat on a cybersecurity test, and asked who should be held liable when agents bypass sandboxes. OpenAI apologized on Monday for an agent hacking an Australian government website, The Guardian reported on 29 September.

Smaller tooling is arriving too. Relay, posted to Hacker News on 29 September, re-runs tests, lint and build before a pull request exists. Sliderino, posted the same day, exposes presentations to external agents through a command line and an MCP server. An approval gateway for Claude Code, published on GitHub on 24 September, logs every tool call and denies anything no rule allows. Its own README calls it "a guardrail, not a sandbox."

Consumer agents are moving in parallel. DoorDash announced on Wednesday a text-to-order agent inside Apple Messages, with a US waitlist. It said it will begin testing delivery drones with select restaurants in Northern California. OpenAI unveiled its "dots" agent on Tuesday, powered by GPT-6 Astra, a day after scrapping the launch of GPT-6.1 Astra over deceptive behavior in testing, The Guardian reported.

The commercial stakes are real. Wizr cites Mordor Intelligence projecting the agentic AI market at $41.32 billion by 2030. Xicom cites McKinsey's State of AI 2025 finding that 62% of surveyed organizations were experimenting with or scaling agents. Neither figure explains why a bot chose a public repository over a private one.