Nobody attacked. The AI agent published the screenshots itself.
If your team uses an AI coding agent, you have probably asked it to do something like this: make the change, then show me a before and after. It is a reasonable request. For a few months, at hundreds of companies, the agent's answer to it was to publish the screenshots on the public internet.
Nobody was attacked and nothing was stolen. The agents were doing what they were asked, as helpfully as they could.
What happened
Researchers at a security company called Glow found more than 13,000 internal images in public GitHub repositories, from developers at more than 300 organisations. The screenshots included customer billing records, an internal payments console, and features that had not been released.
The cause was a gap in a tool. GitHub's command-line program, gh, could write text into a pull request (a proposed code change waiting for review) but could not attach a picture. People got round that by dragging the image into a browser. An agent working in a terminal cannot.
So the agents solved the problem. They created a new public repository, put the screenshots there, and linked to them from the private pull request. Glow reproduced it in a lab and recorded the agent's reasoning: the only way to make the images visible to reviewers "was to host the PNGs elsewhere, so I created a new public repo". The developer saw a tidy before-and-after and moved on.
Two details make this harder to spot than a normal leak:
- The images are mostly not in your company's GitHub. Glow says 93% of cases sat in a repository under an employee's personal username. Checks that only look at the company organisation never see them.
- Scanners read text, not pictures. The tools that catch a password pasted into code do not look inside a screenshot of an admin screen.
About a third of the affected organisations had developers running gitshot, a small open-source tool that uploads screenshots to a public repository by default. Its own documentation warns that the repository is public. In several cases, Glow says, the agent found and used the tool by itself.
At one software company the workaround was saved as a "skill", a reusable instruction file that agents load. Within a week more than a dozen agents were applying it to every ticket.
A caveat about the source
Glow sells software that controls what AI agents can do, so it has a commercial interest in this story. It has not published how it found or counted the images. The Hacker News checked independently and found about 130 public repositories created by gitshot, and confirmed from the tool's code that it publishes to a public repository under the user's personal account by default. The mechanism is real. Treat the totals as one company's count.
Why this matters beyond the screenshots
The agent broke no rule it had been given. It was told to show reviewers the result, it hit an obstacle, and it had permission to create repositories. From the agent's side, that is a task completed.
That is the general problem with agents, in a small and concrete form. You give one a goal and a set of permissions. It will use any permission you gave it to reach the goal, including in ways you never pictured. "It would not do that" is not a control. Not having the permission is.
What to do
- Look in the right place. List everyone who has committed to your private repositories, including people who have left, and check the public repositories on their personal GitHub accounts.
- Check releases and gists, not only files. Images attached to a release do not show in the file list. Search for repositories named
gitshot-imagesand releases tagged_gitshot. - Clean up properly. Delete what you find, and change any password, key, or token visible in an image. Assume a public screenshot has been copied.
- Update gh. Version 2.99.0, released on 1 September, adds an
--attachflag that uploads an image straight into the pull request. GitHub says coding agents can use it. That removes the reason for the workaround. It does not work on GitHub Enterprise Server. - Read the instruction files your agents load. Shared rules and skills are where a one-off workaround becomes standard practice. Remove gitshot unless you have deliberately pointed it somewhere private.
- Put a stop on going public. Creating a public repository, pushing to a personal account, publishing a gist, and switching a repository from private to public should each need a person to approve it. Set that in the agent's permissions and in your GitHub organisation settings, not in a polite request in the prompt.
If you are not technical and your business pays developers, in-house or at an agency, the question to ask is simple. Do your coding tools have permission to publish anything publicly without a person approving it?
How Steelwise can help
Deciding what your AI tools are allowed to do without asking, and checking that the settings match the decision, is the kind of AI advisory work we do. Get in touch if you would like to talk it through.