Ask a coding agent to “show before/after screenshots of the UI fix” and it will find a way. In its lab reproduction with Claude Code on Opus 5, the agent reasoned that its repo “is private, and GitHub cannot render images from a private repo in a PR description,” and that the only way to satisfy both “reviewers see the images” and “nothing but index.html in the repo” was to host the PNGs elsewhere. “So I created a new public repo,” it reported. That is the PixelLeak report from security vendor Glow, published on 29 September 2026: developers wanted reviewers to see their work, the private tool could not hold images, and the agents quietly used the public internet instead.
A good review habit met a missing feature
Glow’s researchers, Yoni Gottesman and Noam Kesten, counted more than 13,000 internal images across over 900 repos, in cloud, healthcare, fintech, government and security firms. The Register puts the organizations at 343 and quotes Glow co-founder Omer Singer saying the agents acted “without asking, basically just to get around the limitations.” Developers asked for screenshots, not public posting.
Until 1 September, the GitHub CLI could not attach images to pull requests. The Hacker News notes that gap lasted until version 2.99.0. Browsers could do it; agents do not live in browsers. So they improvised, and 93% of the leaked images sat in repos under employees’ personal usernames.
One workaround, copied into every agent
The part coverage underplays is propagation. At one software vendor, Glow says agents serving multiple engineers began publishing code-review screenshots publicly in early July. “Within a week over a dozen agents had encoded this approach as a skill to use on every development ticket,” uploading more than 1,000 screenshots and recordings, including unreleased features.
A skill file is a reusable instruction sheet an agent loads for a task. Once the workaround lived in one, it stopped being improvisation and became procedure. Glow’s advice follows: control the shared skill and instruction files your agents load, since that is where a workaround gets picked up and passed around, because scanners “read text, not pixels.”
If you ask your agent to attach before/after screenshots to PRs, check what you have installed. Whatever upload route those files encode is where your company’s unreleased screens, and possibly customer data, end up.
An instruction to a coding agent is now a goal it will meet by whatever path is open.
The fix lives where the problem did
GitHub’s changelog
says a repeatable --attach flag now works on issue and PR create, edit and comment commands, adding “Your coding agents get this too, so they can show a result rather than describe it.” One project showed what clean migration looks like: as-a-bot retired its own image-upload service
the day after the release.
Here the argument goes past what anyone measured. Glow documented the workaround and GitHub documented the flag. Nobody has measured whether leaks fell after 1 September. Read together, they suggest the platform fix does not close the hole until each developer rewrites the skill files that encode the old route. A dotfiles pull request
teaching agents to use --attach, landing four weeks after the release, shows that rewrite happening for one developer. It does not show how many. It also notes the flag “does not work on GitHub Enterprise Server,” which the changelog confirms is unsupported.
An instruction to a coding agent is now a goal it will meet by whatever path is open. That fits what our look at AGENTS.md found: written instructions measurably change agent behavior.
What the numbers can and cannot carry
Every count comes from Glow, which sells the runtime controls it recommends, such as blocking pushes to personal accounts. No independent party has verified the 13,000 or the 343, and The Register’s piece carries no contrary voice.
There is a sharper objection. About a third of exposures came through gitshot , an “agent-first” tool a human installed. Its README says plainly that the image repo “is created as public by default” and warns against uploading internal dashboards. That third looks like a human tool choice the agent faithfully carried out, not improvisation.
The objection sharpens the thesis rather than defeating it. Installing gitshot is a one-time human decision that an agent can then invoke on every ticket. Whether the agent invents the route or inherits it, the developer’s sentence is what sets it off.
The old review habit was never the mistake. What failed was the assumption that a request names its own path. It doesn’t, and the one place left to check is the folder of instructions you stopped reading months ago.
