Proving a change worked, in public

Glow Labs published its PixelLeak research on September 29. The starting point is a mundane habit: a developer changes a layout, then asks a coding agent to prove the visual change worked and attach the evidence for the reviewer. GitHub's own image hosting lives inside the pull-request interface and assumes a browser. Coding agents work through a text-only command line. Faced with a tool they could not use, the agents did what agents do: they found another way.

That way was to put the screenshots somewhere a reviewer could load them — an adjacent world-readable repository, a gist, or a third-party helper. Glow counts more than 13,000 internal images published openly this way, across 900-plus repositories and over 300 organizations, including one of the world's largest technology companies, a frontier AI lab, a major enterprise software vendor, and a Fortune 500 travel company. None of them meant to publish a thing.

The images are not blank. At a manufacturer with more than 100,000 employees, an agent working on an internal billing screen posted screenshots that included billing records for a utility company caught in the fix. At a financial services firm, the leaked material included the internal treasury and settlement console, a dollar-withdrawal screen for a named institutional client, and two screen recordings that walk through the money-movement console rather than showing a single frame. A payments company had four employees with their own gitshot repositories.

Glow stresses that the exposures came to light through its research rather than through the organizations' own security teams. The agent sessions ran on employees' laptops, and the images sat in accounts that the corporate tooling was not watching.

Part of the reason it spread is that the workaround was teachable. Around a third of the affected organizations had developers running gitshot, a small open-source tool that publishes screenshots for code review; anything it uploads lands under a tag called _gitshot, downloadable by anyone who knows to look. Glow found more than 100 public accounts leaking internal development work that way.

The most complete case was a software vendor where public screenshotting became standard practice. Agents serving several engineers started publishing review images in early July, and within a week more than a dozen agents had written the move down as a shared skill to run on every development ticket. On that one skill they uploaded over a thousand screenshots and recordings of the company's product, alongside summaries of features that were still weeks or months from release.

PixelLeak's uncomfortable finding is about where the images live. In 93 percent of the cases Glow examined, the repository belonged to an employee's personal GitHub account rather than the company's organization — outside everything an organization-scoped scanner looks at. Glow began notifying affected organizations on September 9, but says others are likely exposed.

Its advice follows the shape of the leak: audit the people who commit to your private repositories rather than only your organization, include departed employees, check releases and gists and not just file listings, and do not trust text-based secret scanners, because, as Glow puts it, they read text, not pixels. Glow demonstrated the same failure in its own lab, where an agent running Claude Code Opus 5 was asked to preview a header-colour change and reasoned that a private repo would render the images broken for the reviewer, so it created a new public repository to hold them. The agent was solving a display problem. It did not consider that the whole internet could see the result. Glow sells the runtime controls it recommends, and says its customers are already protected.