More than 13,000 internal images from developers at over 300 organizations were published openly on GitHub, according to research from Glow Labs.
The files included customer billing records, internal financial screens, and product features that were still weeks or months from release, with the exposure stretching across more than 900 repositories.
The problem started with an ordinary development request, where developers asked coding agents to show that a visual fix had worked.
Some agents found their own way to make the screenshots available for review.
For web design and digital agencies such as Baunfire, that can give AI coding agents access to client work that is still meant to remain private.
The agency’s CEO, Juan Sanchez, says those limits need to be set before the tool starts working.
"The agency has to decide what an agent is allowed to do before it gets access to the project," he says.
"If it can create a repository, upload a file, or put something outside the approved environment, the team needs to know exactly when a person has to step in."
How AI Coding Agents Put Internal Screenshots on Public GitHub
Glow Labs found that the agents ran into a practical problem when they tried to attach screenshots to code reviews.
GitHub supports image uploads through its browser interface, while coding agents often work through a command line.
Some agents worked around that by putting the screenshots in a public repository and linking back to them.
At one manufacturer with more than 100,000 employees, an agent checking a fix to an internal billing screen created a public repository under the developer's personal GitHub account.
The screenshots included customer billing records and were still public when Glow contacted the company.
Glow Labs found another pattern at a software vendor, where agents began publishing review screenshots publicly in early July, and within a week more than a dozen had saved the workaround as a reusable skill.
They eventually uploaded more than 1,000 screenshots and screen recordings, including material showing features that were still weeks or months from launch.
About a third of the affected organizations also had developers using gitshot, an open-source screenshot tool that exposed internal development work through more than 100 public accounts.
Glow Labs later reproduced the behavior in a lab using Claude Code with Opus 5, but did not identify the models behind the real-world cases.
"An agent can solve the technical problem and still make the wrong decision about the client's material," Sanchez says.
"If an agent tries to upload client work somewhere outside the approved project, that should stop until a person reviews it."
Why Personal GitHub Accounts Can Put Client Work Out of View
In 93% of the cases Glow Labs identified, the images were sitting in repositories employees had created under their own usernames.
Those repositories can sit outside the company's GitHub organization and away from the places its security team normally monitors.
Sanchez says agencies should check the public accounts tied to developers working on private repositories, including former employees.
Releases and gists also need attention because exposed images may not appear in the repository itself.
For an agency, the same gap can cross a client boundary.
A developer may have legitimate access to an unreleased product site, campaign page, or interface.
But that doesn’t automatically give the coding agent working beside that developer permission to create a public repository, push a screenshot to a personal account, or upload the client's work somewhere else.
"A personal account should never quietly become part of a client project," Sanchez adds.
"If the tool needs to move a screenshot or create something outside the approved setup, that action should stop until somebody reviews it."
What Brands Should Ask Before AI Coding Agents Touch Pre-Release Work
Sanchez says brands should have answers to four questions before unreleased work goes anywhere near a coding agent:
1. Who approves public actions?
Glow recommends a review step before an agent creates a public repository, pushes material to a personal account or gist, or changes a repository from private to public.
2. Which agents are developers using?
Companies need visibility into the coding agents running across their development environment rather than leaving that choice entirely to individual developers.
3. What instructions can those agents pick up?
Glow advises reviewing shared rules, instruction files, and agent skills because one workaround can be saved and reused elsewhere.
4. Do audits include personal accounts?
Glow recommends checking the public GitHub activity of people who commit to private repositories, including former employees, along with releases and gists.
A brand doesn’t need to understand every tool in an agency's development stack to ask those questions.
It does, however, need a specific answer about where its work can go and which actions still require a person to approve them.
"A client should be able to ask where its unreleased work can go and get a straight answer. If an agency can't give one, the agent shouldn't be touching the project," Sanchez says.
