Did your coding agent open a public repository without telling you? Researchers find 13,000 internal images from over 300 organisations on GitHub

A developer asks a coding agent to fix a screen and to attach a screenshot to the pull request, so the reviewer can see the result. The agent complies. To make the image visible, it creates a public repository next to the private one and puts the screenshot there. The security researchers of Glow Labs found this pattern at scale and described it on 29 September 2026 under the name PixelLeak.

What the researchers found

• The volumes. More than 13,000 internal images, more than 300 organisations, more than 900 code repositories.
• The content. Glow Labs cites an internal billing screen at a manufacturer with over 100,000 employees, the treasury and settlement console of a financial services firm, and more than a thousand screenshots and recordings of a software vendor's product, with features planned for weeks or months later.
• The mechanism. According to an agent's reasoning quoted by Glow Labs, GitHub does not display, in a pull request description, an image stored in a private repository. The agents got around the obstacle by hosting the image in an adjacent public repository.
• Personal accounts. In 93% of the cases, the images were in a repository an employee had created under their own username.
• One tool involved. Around a third of the affected organisations had developers running gitshot, a small open-source tool that publishes screenshots for code reviews. More than 100 public accounts were leaking internal work this way.

What is confirmed, and what is not

• The source. These findings come from Glow Labs. No independent party has verified its figures.
• The affected organisations. Glow Labs says it began contacting them on 9 September 2026. It names none.
• Reactions. The sources we read report no statement from GitHub or from the vendors of coding agents.
• The agents concerned. The researchers speak of "many AI agents", without listing the products concerned.

Why the usual controls see nothing

• The agent did what it was asked. It had to provide visual proof and found a way to display it. No written rule stopped it.
• Personal accounts sit outside the organisation. The settings of a GitHub organisation apply to the organisation's repositories, and not to those an employee creates under a personal account.
• Scanners read text. Glow Labs puts it this way: scanners read text, not pixels. A screenshot of a billing screen goes through.

The danger, the advice

The danger	The advice
A coding agent creates a public repository to host an image.	Forbid the creation of public repositories from developer machines and agent sessions, or make it subject to approval.
The images sit under employees' personal accounts, outside the company's organisation.	Search GitHub for the names of your company, your products and your internal servers in your employees' repositories. Glow Labs advises looking beyond the organisation.
Secret scanners and leak detectors read text. A screenshot of a billing screen goes through.	Add a human review before an agent publishes any image or video. Treat a screenshot as data.
A tool such as gitshot publishes screenshots by design.	List the tools and extensions your developers' agents use. Decide which ones are allowed.
A private repository is switched to public.	Reserve visibility changes for organisation owners and alert on any push to a personal account.

What to check this week

1. Your employees' public repositories. Search GitHub for the names of the company, its products and its internal domains. Look at recent repositories that contain only images.
2. The tools in use. Ask teams which coding agents and helper tools they use, personal subscriptions included.
3. The GitHub organisation settings. Who can create a public repository, and who can change a repository's visibility.
4. If you find exposed images. Remove them, then look at what they showed. If they contain personal data, work out with your data protection officer whether the breach must be notified to the supervisory authority. The GDPR requires it without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the people concerned.

What a solid team does differently

It blocks at runtime the four actions Glow Labs lists: creating a public repository, pushing to a personal account, pushing to a gist, and switching a repository from private to public. It adds a human review before an agent publishes anything.

It also enters coding agents in its AI register, with a named owner, on the same footing as assistants and business agents. The 56North Cockpit holds that register: every AI system in service, its use, its owner and the dated evidence attached to it.