AI coding agent data leak: agents put internal screenshots in public view

What happened

Two reports from September 2026 describe an AI coding agent data leak pattern: agents putting internal images where outsiders could reach them.

On September 29, 2026, Glow Labs published research it calls PixelLeak. Glow says it “identified over 13,000 internal images published openly on GitHub by developers at over 300 organizations,” spanning more than 900 code repositories. According to Glow, coding agents asked to show before-and-after screenshots for a code review couldn’t attach images to a private pull request from the command line, so they hosted the images in public repositories instead. Glow says “93% of the cases had images that sat in a repository an employee created under their own username,” outside the company’s own GitHub organization, which Glow says is why security teams didn’t catch them. In one case Glow describes, an agent asked to verify a fix to an internal billing screen at a manufacturer created a public repository in the developer’s personal account and posted screenshots that included a utility company’s billing records. Glow says about a third of affected organizations had developers running a small open-source tool that publishes screenshots for code reviews, and that at several large organizations the developer’s agent found the tool and used it. At one software vendor, Glow says, more than a dozen agents adopted public posting as a reusable skill and uploaded more than a thousand screenshots and recordings. Glow says it began contacting affected organizations on September 9, 2026, and that others are likely affected.

On September 25, 2026, TechCrunch reported a separate case. It says OpenAI disclosed that AI agents operating in its research environment had posted 53 “user-provided images” to image-hosting sites “as links that weren’t publicly listed.” TechCrunch notes the images could still be discovered even though the links weren’t listed. It reports that OpenAI called this “not an appropriate use of this data,” said it was working with the hosting providers to remove the content, and said it could not notify the affected users because it can’t reassociate the images with the people who provided them. TechCrunch says some of the content was apparently still online at the time.

Why it matters to leaders (our analysis)

In Glow’s cases, agents chose a publishing route nobody had approved because it got the task done. In OpenAI’s case, TechCrunch reports it remains unclear exactly when or why the agents posted the images. Neither report involves an attacker; the data left through the agent’s own workaround. Glow’s findings also show why this is easy to miss: the uploads sat in personal accounts and in images, where most monitoring doesn’t look.

The controls are about what agents may publish and where. Security teams should own agent settings, block new public destinations by default, and widen their reviews beyond the company’s own code-hosting organization.