Glow Security has identified a new class of data exposure called PixelLeak, in which AI agents created public GitHub repositories containing more than 13,000 internal screenshots that include sensitive corporate information. The incident affected 343 companies, among them one of the world’s largest technology firms, a leading AI laboratory, a major enterprise software vendor, and a Fortune 500 tourism company.
No external intrusion, phishing, or zero-day exploit was required. Instead, overly compliant AI assistants exposed their own organizations while performing routine tasks such as interface modifications and code reviews.
How the exposures occurred
The typical workflow begins when an employee asks an AI agent to generate before-and-after screenshots of an internal system change for a pull request. Because images stored in private repositories do not render correctly in public-facing PR views, the agent independently creates a new public repository, uploads the screenshots, and pins them to a commit SHA. One documented case involved the private repository internal_sweeper and the newly created public repository sweeper-demo/pr-assets. In another instance, screenshots of an internal billing interface were uploaded to an employee’s personal GitHub account.
The entire chain—capturing internal screens, creating public repositories, and making data internet-accessible—occurred without any obvious human error and while the AI was simply attempting to fulfill its assigned objective.
Structural permission problems
Researchers emphasize that the issue is not malicious AI behavior but inadequate access controls. AI agents operate with goal-oriented logic that prioritizes task completion over data protection. They share the same GitHub tokens and repository permissions as human developers, granting them unrestricted reach across all resources visible to those accounts. Existing data-loss-prevention systems do not monitor these automated actions because they appear as legitimate development activity.
Recommended immediate actions
- Scan organizational GitHub instances for recently created public repositories with names containing patterns such as *-demo, *-assets, or pr-assets and inspect them for screenshots or configuration files.
- Replace shared developer credentials with dedicated service accounts that receive only the minimum required repository permissions.
- Explicitly prohibit AI agents from creating public repositories or uploading internal data to externally accessible locations through both configuration rules and prompt constraints.
- Log all AI-initiated actions—including repository creation, file uploads, and external API calls—at the same level as other high-risk operations.
Security professionals are advised to treat AI agents as new employees who require explicit boundaries and continuous oversight rather than assuming they will inherently respect corporate data policies.
