Security firm Glow disclosed on September 29, 2026 that it had found more than 13,000 internal screenshots and recordings, from developers at 300+ organizations, sitting in public GitHub repositories — downloadable by anyone, with no login, and invisible to the organizations' own security scanning because the repos lived under developers' personal GitHub accounts, not their employer's.

What the source says

Per The Hacker News' report on Glow's findings: until September 1, 2026, GitHub's CLI (gh) had no way to attach an image to a pull request — that only worked in the browser. CLI-driven coding agents asked to show a UI change had no sanctioned way to put a screenshot in front of a human reviewer, so agents and the developers directing them worked around it.

The most common workaround, used by about a third of the affected organizations, is gitshot — an open-source "skill" installable in 40+ coding agents that, by default, creates a public repository (typically <username>/gitshot-images) under the developer's personal account and stores screenshots as public release assets. Its own README says this is public — and refuses to use a private or org-owned repo instead. Glow says the pattern also spread socially: at one company, one engineer's agent started doing it, and within a week over a dozen developers had saved it as their own reusable skill, after which those agents uploaded 1,000+ screenshots and recordings, including unreleased features.

Confirmed examples Glow found before anyone was notified: a utility company's billing records, exposed under a manufacturer's developer account; and at a financial services firm, screenshots of an internal treasury/settlement console, a withdrawal screen naming a specific client, and recordings of money-movement workflows.

GitHub's gh 2.99.0 (September 1, 2026) added an --attach flag that removes the reason agents reached for the workaround — but doesn't retroactively secure anything already public, and doesn't work on GitHub Enterprise Server.

What it doesn't establish

The article is specific about what it can't confirm: whether anyone besides Glow's own researchers actually downloaded the exposed images; which AI models were involved in the real-world cases (Glow didn't name them — only its own lab reproduction used Claude Code); and whether every public gitshot repo it found (roughly 130, by a search on the disclosure date) is actually exposed agent output versus something else entirely. Glow's statement that other organizations are "likely affected" is a stated expectation, not a confirmed count. Worth noting in the interest of full disclosure: Glow sells agent-control software, which doesn't make the finding wrong, but is a reason to read the underlying report rather than take any one summary's framing at face value.

We've scored this 10/10 (critical) in our own system — not because it's independently reproduced (it rests on one security firm's report, which is why we flag verified: false), but because the scope (a skill usable across 40+ agents, confirmed at 300+ real organizations) and impact (customer billing data, an internal treasury console) are about as high as this scale goes for a disclosed, non-lab finding.

Why it matters anyway

This isn't a model behaving badly — it's a tooling gap that a popular workaround solved by defaulting to public, and a blast radius that stayed invisible to corporate security tooling specifically because the exposure happened under personal accounts, not org ones. If any agent on your team has ever needed to show a screenshot in a PR, it's worth checking what it actually did to make that happen.

Full scoring breakdown and source: https://www.stupidllm.com/incident/STUPID-2026-0165/