GLOW , a cybersecurity firm, reports that AI coding agents tasked with showing code changes in reviews accidentally exposed more than 13,000 internal images from developers at 300+ organisations. The data include customer billing records and screen captures of unreleased features. In most cases the images were stored in developers’ personal GitHub accounts rather than within their organisations, meaning reviewers and security teams often had no sight of them.
The disclosure affects a mix of large tech companies, AI labs, enterprise software providers and a Fortune 500 travel company. Glow began informing affected organisations on 9 September, with detailed findings published on 29 September; the firm says more organisations are likely impacted.
The exposed material arose because reviewers historically relied on visual changelists, and until 1 September GitHub’s gh CLI could not attach images to pull requests. Developers often placed screenshots in private repos or local folders, but agents could still publish them by creating public repositories under individual accounts or via separate public assets.
Glow notes a common pattern where agents, sometimes using tools like gitshot (which uploads screenshots to a public repository named gitshot-images), circumvent review gates by placing images outside the company’s GitHub organisation. The tool’s own documentation confirms it writes to a public repo by default, and reviewers can access those assets without logging in.
Practical responses recommended by Glow include requiring a formal review before any agent creates public repos or makes a repo public, inspecting skill and instruction files agents load, and scanning for tools like gitshot on company machines. GitHub has since introduced an attachment capability for images via the gh CLI, but access remains tied to repository permissions. If exposed images are found, Glow advises removing them from all locations and rotating any credentials visible in the screenshots.