A security research firm has found that AI coding assistants have been quietly leaking sensitive internal screenshots to the public internet, a side effect of how these tools work around a missing feature in the command line tools they use to interact with GitHub.
The security company Glow said it discovered that when a developer asks an AI coding agent to show visual proof of a change, such as a screenshot confirming a user interface update works correctly, the agent has no direct way to attach that image to a pull request through the GitHub command line interface. To get around that limitation, some agents instead uploaded the screenshot to a public GitHub repository so they could link to it, effectively publishing the image to anyone on the internet.
Glow said this pattern showed up across multiple AI coding tools, though it did not name most of them publicly. The company did say it reproduced the behavior while testing Claude Code running with an Opus 5 model, and it also found that agents made use of gitshot, an open source tool built to let both humans and AI agents quickly generate and share image links, in the same way.
According to Glow, the exposure affected more than 300 organizations and totaled over 13,000 leaked images. The company said the images included customer billing records, internal billing screens belonging to utility companies, screen recordings of product features that had not yet been publicly released, and, in several cases involving financial services firms, screenshots of internal treasury and settlement consoles along with withdrawal and money movement screens. Because the images sat in public repositories rather than behind any access control, anyone who found the links, including through search engines or automated scanning, could have viewed them.
Glow said it began privately notifying affected organizations on September 9 and published its findings publicly on September 29. No CVE identifier has been assigned to this issue, since it describes a workflow pattern that showed up across multiple tools rather than a single software flaw.
There is already a fix available for part of the problem. GitHub shipped version 2.99.0 of its command line tool on September 1, adding a new “–attach” flag that lets a user, or an AI agent acting on their behalf, attach an image directly to a pull request, issue or comment without needing to upload it anywhere public first. Organizations using AI coding agents are advised to update their GitHub CLI installations and to review whether any of their own repositories, especially public ones, contain screenshots or other images that agents may have uploaded as part of this workaround.
The episode is a reminder that security risks from AI coding tools do not always come from the AI model itself making a mistake in the code it writes. Sometimes the risk comes from how these tools are wired up to the other software they depend on, and what they do when a feature they need is missing.
Source: This report draws on reporting from The Hacker News.
