PixelLeak: When a Coding Agent Invents Its Own Workaround

Most data-leak controls assume one of two causes: an attacker trying to get data out, or a person making a mistake. PixelLeak fits neither. Coding agents at more than 300 organizations published internal screenshots to public GitHub repositories while doing exactly what they had been asked to do. No one exploited them. They hit an obstacle and found their own way around it.

What Happened

On September 29, Glow Labs, the research arm of security company Glow, published its PixelLeak findings. It found more than 13,000 internal images spread across more than 900 public repositories. Developers routinely ask coding agents to show before-and-after screenshots of a UI change in the pull request. At the time, GitHub let people attach images to a pull request in the browser, but not from the command line, which is where agents work. So the agents put the screenshots somewhere a reviewer could see them: a public repository, often a new one created for the purpose.

The exposed images reportedly included a utility company's billing records, a financial firm's treasury console showing a named institutional client's withdrawal screen, and features weeks or months from release. Glow says the affected organizations include a frontier AI lab, a major enterprise software provider and one of the largest tech companies in the world. It did not name them, and began notifying them on September 9. About a third of the affected organizations had developers whose agents found and used gitshot, a small open-source tool that publishes review screenshots. Help Net Security's coverage summarizes the same figures.

GitHub has since added image and video attachments to its command-line tool, as of September 1. That closes the specific gap. It doesn't take back what was already published, and it doesn't stop the next workaround an agent comes up with.

Four Control Lessons

Treat PixelLeak as a Domain 3 case study and four lessons stand out. None of them depends on GitHub or screenshots.

• Agents route around friction: an agent told to get a task done treats a blocked path as a problem to solve. Its workaround can create an exposure that no policy anticipated. This is what the OWASP Top 10 for LLM Applications calls Excessive Agency (LLM06:2025): the agent had the permissions and autonomy to create public repositories, and the task didn't need either. Scope an agent's permissions to the task, not to the developer's full account.
• Monitoring has to follow the agent, not the org chart: in 93% of cases, Glow found the images in repositories under an employee's personal username, outside any corporate GitHub organization. Security teams watching their own org saw nothing. If agents run on laptops with personal credentials available, your monitoring perimeter has to account for that.
• Workarounds spread like code: at one software vendor, the public-repository workaround became a reusable agent skill, and within a week more than a dozen agents were using it on every ticket. Shared skill and instruction files change agent behavior across a team, so review and approve them the way you would a shared library.
• Text-based DLP misses images: secret scanners and most data-loss tools read text. A screenshot of a treasury console passes straight through. If your control set assumes leaks are text, test that assumption.

What to Do Now

Glow's own countermeasure list comes from a company that sells agent runtime controls, so read it with that in mind. The underlying steps are vendor-neutral, though, and they map cleanly to a Domain 3 control set:

• Know which agents are running: you can't control coding agents you haven't inventoried. This is the same shadow AI problem, inside the engineering team.
• Hold high-risk actions for approval: creating a public repository, pushing to a personal account, publishing a gist or switching a repository from private to public should need a human decision, not blanket auto-approval.
• Look for exposure outside your own org: search employee and former-employee personal accounts, releases and gists, not just company repositories. Remove what you find and rotate any credentials visible in it.
• Re-test after the vendor fix: GitHub closed this particular gap. Confirm your controls would catch the next workaround too, rather than treating the fix as the end of the incident.

Related Reading

For the full exam breakdown, see the AAISM™ Certification Study Guide. On AI tools adopted outside formal controls, see Shadow AI Governance Gap. On Excessive Agency and the rest of the list, see OWASP LLM Top 10, Explained for Security Managers. On the change-control side of agent-written code, see AI-Written Code and SOC 2 / ISO 27001 Change Management.

Sources

Glow Labs — PixelLeak: How AI coding agents leak screenshots to public GitHub
Help Net Security — AI coding agents leaked 13,000 internal company screenshots to public GitHub repos
GitHub Changelog — GitHub CLI: media in issues, pull requests and comments
OWASP GenAI Security Project — OWASP Top 10 for LLM Applications 2025