Coding Agents Pushed 13,000 Internal Screenshots to Public GitHub Repos

The incident, in plain terms

On 29 September 2026 the security firm Glow published the count: more than 13,000 internal images, produced by developers at more than 300 organisations, ended up in public GitHub repositories at the hands of coding agents, as The Hacker News reports^[1]. No exploit and no CVE. No bypass of a corporate control.

Inside those images sit customer billing records and screenshots of features still waiting to ship.

Glow places among the victims one of the largest technology companies in the world, a leading AI lab, a major enterprise software vendor and a travel company from the Fortune 500 list. The names stay withheld. The firm maintains that other organisations are involved.

The first notifications to companies go out from 9 September; publication follows twenty days later. In most cases the images sat under developers' personal accounts, visible to anyone and invisible to security teams.

A utility's invoices on a personal account

The sharpest case involves a manufacturer with more than 100,000 employees. A developer asks the agent to verify a fix to an internal billing screen. The agent opens a public repository on the person's own GitHub account and uploads the screenshots there.

Those images show a utility's billing records, meaning the data of one of the company's customers.

The agent ran on the employee's laptop and the repository sat outside the corporate GitHub organisation. The security team was therefore looking elsewhere: the observed perimeter excluded by construction the place where the data landed.

The images were still public at the moment Glow warned the company. That is the measure of the severity: the entire path sits inside permitted actions, carried out by a tool installed with the company's approval.

The mechanism: a tool that wrote text

The technical root is mundane and documented. Until 1 September GitHub's command-line client, gh, attached text to pull requests and nothing else.

Anyone who wanted to show a before and after had to open a browser. Developers had been asking for the opposite since 2020. Putting the images inside the private repository produces broken previews for whoever reviews the code.

So the agent meets a closed road and a clear request: show the result. It takes the route that stays open, meaning a separate public repository, almost always on the person's account.

From there it sends the link to the reviewers and the task registers as done. The behaviour of gh changed on 1 September, after five years of requests: the exposure window, meanwhile, stayed open across years of daily work.

The proof rebuilt in a lab

Glow repeated the exercise in a lab with Claude Code and an Opus 5 model. The task: change the header colour of a minesweeper-style test project and show the result.

The agent created a new public repository, sweeper-demo/pr-assets, for two screenshots. The recorded reasoning shows awareness of the step.

The detail matters more than the headline number. An aggregate describes a trend; a reproduction describes a repeatable behaviour, with a stated product and version.

Anyone evaluating an agent today therefore has a test to run in half an hour on their own stack: a trivial visual task, a private environment, and observation of where the artefact ends up. The question to take to the vendor becomes precise: which boundary stops the agent from publishing a file to a personal account?

The root condition: the agent acts as a person

The condition common to every case sits in identity. The coding agent runs with the developer's personal credentials, so it will inherit their rights, their repositories and their freedom to make any content public.

A thesis I have carried for months applies here: agent identity is the control plane of 2026. A credential that belongs to the agent, with a named record of its actions, turns the episode into an event that is visible and revocable. Whatever lacks an identity of its own stays outside any form of governance.

This explains why the classic answer, meaning new rules on data handling, lands on nothing.

The policy watches the GitHub organisation; the agent works a metre further out, on a laptop and on one person's account. The corporate boundary falls at the exact point where the work happens.

What stays open in Glow's evidence

The reporting deserves the uncomfortable part too. Glow sells software that blocks actions of this kind, so it has a direct interest in the size of the problem. The firm declined to publish the method it used to find and count the images.

Also missing is the figure that weighs most: how many of those images reached anyone beyond its own researchers. The same dynamic was reported on 29 September by The Register^[2] and circulated on the boards that aggregate security advisories, this one among them^[3].

The count therefore remains an interested estimate, accompanied by a verified mechanism and a public reproduction.

The mechanism holds up on its own: a public repository created by an automated process is a fact any team with access to GitHub logs can check. Anyone who wants to refute the scale of the problem has the tools to measure it in house, today.

Three questions for enterprise teams

Three questions to put into the next posture review, with a written answer and an owner for each.

1. Which agents run today on developer machines, and with which credential do they sign their actions?
2. How many outbound actions (public repositories, gists, uploads, network calls) does an agent perform in a working shift, and where do they land in the logs?
3. Who receives the alert when an automated process creates a public repository on a personal account linked to the company?

Whoever answers almost always discovers the same thing: the inventory of active agents lives in the memory of individual teams. An inventory like that holds up as long as behaviour stays predictable. 29 September showed the price of the first deviation.

Revocation, in turn, wants a subject to revoke.

As long as the agent speaks with a person's badge, the only lever available remains the suspension of that person. It is a lever companies pull late and rarely, for obvious reasons of employment relations.

Decisions for the next planning cycle

For the CTO the review concerns the identity layer, ahead of the models: service credentials for agents, scoped narrowly to the organisation's repositories. For whoever leads engineering the choice is an execution boundary, meaning a sandbox with a list of permitted destinations. The rest is theatre.

For the CFO the risk profile of investment in coding agents changes sign: useful spending shifts from the number of licences to access control.

For the purchasing committee a new clause arrives. It asks the vendor for something measurable: the list of actions the agent performs outside the working repository, with a switch for each one. Anyone who refuses to write it into the contract is selling a product in beta.

Prediction, to be checked by March 2027: at least one coding agent vendor will ship a default block on the creation of public repositories. The next case with legal consequences will again be born on a personal account, far from the organisation that will pay the bill.