AI Agents Leak 13,000+ Sensitive Screenshots via Public GitHub Repos, Glow Security Finds

Cybersecurity research firm Glow Security has discovered that multiple AI agents created public GitHub repositories containing over 13,000 screenshots, some of which include sensitive information from technology companies. The leak method has been dubbed "PixelLeak."

Researchers explained that when humans ask AI agents to provide before-and-after comparison images of a project, the agents need to capture screenshots. Since GitHub cannot render images from private repositories in pull requests, agents may host PNG files in public repositories, leading to data exposure.

According to Glow Security, 343 companies have leaked sensitive information this way, including one of the world's largest technology companies, a leading AI lab, a major enterprise software vendor, and a Fortune 500 travel company. In one case, a company used an agent to fix an internal billing interface, and the AI uploaded screenshots to a public repository under an employee's personal GitHub account to show the changes.

When Glow Security notified the affected company, the leaked screenshots were still publicly accessible. The firm advises organizations to immediately audit their data exposure and strengthen permission controls over AI agents.