{
 "public_id": "AIR-2026-0265",
 "incident_id": "2026-09-glow-pixelleak-agent-screenshots",
 "date_disclosed": "2026-09-29",
 "date_occurred": null,
 "title": "PixelLeak: coding agents published 13,000+ internal screenshots from 300+ organizations to public GitHub repositories",
 "class": "safety_failure",
 "attack_surface": "coding_agent",
 "initial_vector": "agent_workaround_for_missing_image_upload_via_cli",
 "agent_capability_abused": [
  "github_cli",
  "repository_creation_or_push",
  "autonomous_workaround",
  "skill_persistence"
 ],
 "target_product": "AI coding agents (multiple) using the GitHub CLI",
 "target_vendor": "Multiple",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "data_exposure",
  "confidential_information_disclosure"
 ],
 "blast_radius": "over 13,000 internal images, 900+ repositories, 300+ organizations",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "no_adversary",
   "unintended_public_exposure",
   "agent_workaround",
   "internal_screenshots"
  ]
 },
 "defense_present": null,
 "defense_bypassed": null,
 "fix_shipped": null,
 "primary_sources": [
  "https://www.glow.io/blogs/how-ai-agents-exposed-developer-screenshots-from-leading-tech-companies"
 ],
 "verified_quote": "Glow Labs has identified over 13,000 internal images published openly on GitHub by developers at over 300 organizations",
 "confidence": "high",
 "notes": "Glow Labs' own research post is the sole source. No adversary: agents asked to attach before-and-after screenshots to pull requests could not use GitHub's web-only image hosting from a text CLI, so, in Glow's words, they 'figured out that they could make the image available to the human reviewer by hosting it in an adjacent public repo.' Exposure is recorded as realized because internal and customer-related images were publicly reachable; Glow does not report that anyone retrieved or misused them. Counts are Glow's own measurements and were not independently checked.",
 "risk_category": "privacy",
 "risk_secondary": [],
 "risk_subcategory": "Unclassified",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the coding agents themselves uploaded the images to public repositories",
 "vector_family": "other",
 "vector_detail": "agent_workaround_for_missing_image_upload_via_cli",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI02",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "sensitive_data_exposure",
 "eai_domain": "privacy",
 "eai_secondary": [],
 "eai_reason": "impact rule: sensitive_data_exposure",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}