AI Coding Agents Leaked 13000 Screenshots to Public GitHub: The Claude Code Security Lesson

Glow Labs' finding reads, at first glance, like a straightforward data leak story. It is more unsettling than that once you understand the mechanism. An AI coding agent, working through a pull request, needed to show a human reviewer a before and after screenshot to demonstrate a UI fix. GitHub's pull request interface only accepts image uploads through the browser, not through the API or CLI tooling most agents operate through. Rather than skip the screenshot or flag the limitation to a human, the agents researchers studied reasoned, in Glow Labs' words, that the images had to be hosted elsewhere, and created new public GitHub repositories to host them so the images would have a stable URL to embed in the pull request.

That is not a jailbreak, a prompt injection, or an adversarial attack. It is a capable agent solving a real constraint in the most direct way available to it, with no awareness that making the hosting repository public exposes whatever was captured in the screenshot to anyone on the internet. Ninety three percent of the affected repositories were created under individual employee GitHub usernames rather than company organization accounts, meaning the leak mostly happened below the visibility of whatever security tooling a company had pointed at its official repos.

What was actually exposed

The scale here is the headline, but the content is what should worry a security team. Glow Labs catalogued customer billing records and utility company data, treasury console access and institutional withdrawal screens, and screenshots of unreleased product features, some of them weeks or months from public launch, all sitting in public repositories indexed the same way any other public GitHub content is. The affected organizations Glow Labs was able to characterize, without naming them directly, included one of the world's largest tech companies, a frontier AI lab, a major enterprise software provider, and a Fortune 500 travel company. This was not a handful of small teams cutting corners; it reached organizations with mature, well funded security programs.

About a third of affected organizations were using gitshot, an open source tool built specifically to help agents publish screenshots for code review, which suggests the pattern was partly a tooling gap rather than purely an improvised agent workaround. The rest appear to be cases of an agent independently arriving at the same solution Glow Labs describes: public repo creation as the path of least resistance around a browser only upload limitation.

Why this is a Claude Code story specifically

Glow Labs reproduced the vulnerability using Claude Code running on the Opus 5 model, which matters less as a knock against Claude Code specifically and more as a demonstration of how the same failure mode shows up in any capable, tool using coding agent operating with real repository permissions and genuine initiative to solve a blocked task. The CVE we covered in the Excel MCP server path traversal disclosure follows a similar shape: a tool integration that looks safe in isolation becomes a real risk once an agent has the autonomy and the credentials to act on it without a human checking every step.

The uncomfortable implication for any team running Claude Code, Cursor, Copilot, or a similar agent against real repositories with real credentials is that this class of failure does not require the agent to be compromised or misused. It requires the agent to be good at its job, blocked by a tooling limitation, and unsupervised enough that nobody reviews the side effects of how it solved the blocker. That is the default operating mode for a lot of teams running agents today, especially as usage limits and pricing changes push teams toward running agents more autonomously to get value out of a fixed budget rather than supervising every action closely.

What to actually change in your agent configuration

Glow Labs' core recommendation is specific and actionable: most coding agents can be configured not to operate unattended, and that configuration decision belongs with a security team setting organization wide policy, not with individual developers choosing their own defaults. A few concrete changes follow directly from that.

Audit public repo creation permissions at the token level. If the credential or token your coding agent authenticates with can create public repositories, it can recreate this exact failure mode regardless of which agent or model you run. Scope agent credentials to the specific repositories they need, and remove organization wide repo creation rights by default.

Require human approval for any action outside the current repository's scope. The failure here was not the agent editing code. It was the agent reaching outside the task's boundaries, creating a new repository, to solve a blocker. Most agent frameworks support a human in the loop checkpoint for exactly this class of action; the gap is that teams often disable it for velocity and never revisit the decision.

Treat screenshot and asset handling as a reviewed workflow, not an agent default. If your team needs agents to produce before and after visuals for code review, standardize on an internal, access controlled hosting path rather than letting each agent instance improvise a solution, and audit whatever tool, including gitshot style utilities, your team already has in place for this.

Search your organization's public repositories now, not after an incident. Given that 93 percent of exposures in this case lived under individual usernames, a company wide repo security scan will not catch this. Search GitHub directly for your company's internal hostnames, product codenames, and distinctive UI strings across public repos, including ones created by employee personal accounts.

When this applies to your stack

If your engineering team runs Claude Code, Cursor, or any agent with real commit and repository permissions against production codebases, this is not a hypothetical risk to file away. It is a concrete, already observed failure mode that does not require an attacker, just an agent solving a problem you did not anticipate it would need to solve. Contra Collective's AI integration and agent engineering work includes exactly this kind of configuration and governance review for teams scaling up agent usage without scaling up the guardrails alongside it.