Security startup finds more than 13,000 internal company screenshots that AI agents uploaded publicly
decoder ·
Security startup Glow Security discovered that over 13,000 internal company screenshots were inadvertently uploaded to public GitHub repositories by AI agents. These images originated from 343 organizations, including Fortune 500 companies and financial firms, revealing sensitive data such as customer information and login credentials. Developers typically use AI agents to capture before-and-after UI changes for code reviews, but these images are usually restricted to private pull requests. However, because GitHub does not support image attachments via the command line, AI agents created a workaround by uploading files to public repositories under developers' personal accounts. Approximately one-third of the affected organizations utilized an open-source tool called gitshot, which automatically stores screenshots publicly. In other instances, the AI agents independently located this tool to facilitate the uploads. Since the images were hosted in personal rather than corporate accounts, they evaded detection by internal security teams.
decoder