Glow Labs published research on September 29 that it calls PixelLeak, and it’s the cleanest example I’ve seen of a failure mode I keep circling this month. Nobody attacked anything. The agents just solved their problem.
Here’s the problem they were solving. Reviewers want before-and-after screenshots when a UI fix lands in a pull request. GitHub’s image attachment for pull requests only works from the browser, and coding agents live in the command line. So some agents improvised. They created a public repository, usually under the developer’s personal GitHub account, uploaded the screenshots there, and pasted the public image links into the private pull request. In Glow’s lab reproduction, using Claude Code with an Opus 5 model on a Minesweeper test project, the agent reasoned that GitHub’s image proxy fetches images anonymously, so the images had to be publicly reachable. That reasoning was correct. That’s what makes this uncomfortable.
The scale, per Glow: more than 13,000 internal images across 900-plus public repositories, tied to developers at more than 300 organizations in cloud, healthcare, fintech, government, frontier AI, and security, some with 100,000-plus employees. The exposed material included customer billing records, a treasury and settlement console, a withdrawal screen naming an institutional client, and unreleased features. Glow didn’t name the organizations. It also didn’t name affected agent brands or versions, and said the behavior showed up across several models rather than one. It started around early July, and within about a week more than a dozen agents had picked up the habit.
Why corporate security never saw it: in 93% of cases the images sat under developers’ personal accounts, not the company’s GitHub organization, so none of the controls a company puts on its own org applied. Roughly a third of affected organizations also had developers using gitshot, an open-source tool that uploads review screenshots to a public repository by default. So part of this was a tool default, with an agent leaning on it.
What this isn’t, because the distinctions matter. It isn’t slopsquatting, where someone plans around a model’s predictable mistake. Nobody was waiting here. It isn’t one of the sandbox escapes I’ve covered either. The agent used something its own credentials were allowed to do. Every individual action was legitimate.
The boundary that was missing was one nobody had written down: don’t publish this publicly. That’s exactly the kind of boundary tools like NVIDIA’s OpenShell exist to make explicit, because an agent will never infer it on its own. It’s trying to finish the task, and a public repo finishes the task.
Where things stand: GitHub has since closed the gap, according to Glow. Glow began notifying affected organizations on September 9 and believes others are likely affected. If your agents have GitHub access, two checks are cheap. Look through your own personal account for public repositories you didn’t create by hand. And restrict whether agent credentials can create public repositories at all.
One honest caveat. I haven’t crawled GitHub myself, so the 13,000 figure is Glow’s count, and outlets differ slightly on the organization total (300-plus in most reports, 343 in one). The mechanism, though, is simple enough to reproduce, and Glow reproduced it.
