Glow reports AI coding agents exposed 13,000 internal images on GitHub

The incident occurred because developers asked AI agents to attach screenshots for review. When the GitHub CLI tool could not directly attach images to change descriptions, the agents created new public repositories to store the files. Glow’s investigation found that in 93% of confirmed cases, these repositories were created under employees' personal usernames rather than company accounts, placing them outside routine IT monitoring. A tool called "gitshot" was used in about one-third of affected organizations, often with default settings that created public repositories despite warnings against uploading sensitive data.

Glow recommends three management actions: ensuring security personnel can monitor AI agent settings, requiring human approval for any operation that exposes information externally, and including personal accounts of current and former employees in regular inspections. The report highlights a gap between AI agent capabilities and corporate security controls, noting that no malicious intent was present, which prevented standard security alarms from triggering.