Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free Trial
Key takeaways
An AI agent doesn’t have to go rogue to put an organization at risk. Recent research found agents doing exactly what they were told to do — and pushing more than 13,000 internal images into public view in the process.
The research, published September 29 by Glow researchers Yoni Gottesman and Noam Kesten, describes a pattern the company calls PixelLeak. Each case started the same way: A developer asked an agent whether a visual change worked. The agents were text-only and had no sanctioned path for posting an image, so they hosted screenshots in public GitHub repositories where their human reviewers could see them.
More than 300 organizations were affected, among them one of the world’s largest tech companies, a frontier AI lab, a major enterprise software provider, and a Fortune 500 travel company. The exposed images included customer billing records, internal treasury and settlement consoles, and views of unreleased product features. Glow counted more than 900 repositories spanning cloud, health care, fintech, government, frontier AI, and security organizations, some with more than 100,000 employees.
“I think this is hilarious because I’ve seen human developers do this for the past 24 years,” said John Strand, owner of Black Hills Information Security. Developers who are handed a goal but given no approved way to reach it have always improvised a place to host something, he said, and penetration testers have been exploiting that habit for decades.
“This shows AI agents getting closer to what humans do, probably because they were trained on what humans do.”
—John Strand
Here's what you need to know about PixelLeak.
[ See webinar: Why red teaming the build pipeline is essential ]
Agents most often break security protocols when the assigned task is benign but a technical limitation blocks it, said Steven Swift, managing director of Suzu Labs. Earlier agents simply reported back that they could not finish and gave up before trying a workable option. Because users were frustrated by this, model providers responded by training agents to persist and exhaust their options before declaring failure. One result of that persistence training was the OpenAI/Hugging Face incident.
Another is PixelLeak. The agents could not reach GitHub’s image hosting for private repositories and were limited to text, so they found another route. “That workaround leaked private screenshots, because agents thought it was the best way to get the data shared as required,” Swift said.
The repositories were often created in developers’ personal accounts, he added, which places them outside any organization-level review.
“Organizations could vet 100% of their org-managed repos and still miss the data leak sitting in a public, personal repo controlled by one of their developers.”
—Steven Swift
Screenshots of internal applications are free reconnaissance, said Jim Sherlock, vice president for AI and cybersecurity R&D at ProCircular. They show internal hostnames and URLs, the names of internal tools, which vendors and frameworks a company runs, who works on what, and what the internal systems look like. They also capture what nobody intended to capture, such as a token sitting in a URL bar or a terminal with environment variables printed out.
Glow found that 93% of the cases it reviewed involved images in developers’ personal accounts. “Most companies govern their GitHub organization carefully but can’t see what an employee’s personal account is doing at all,” Sherlock said.
“Agents run with the developer’s credentials. That makes the developer’s personal account part of your attack surface, whether you planned for it or not.”
—Jim Sherlock
A screenshot of an internal console is a map, said Dor Sarig, co-founder and CEO at Pillar Security. It can expose hostnames, URLs, workflow steps, account structures, and employee names that an attacker would otherwise spend weeks reconstructing. Treasury and withdrawal screens show which approval steps to imitate in a payment-fraud or credential-phishing lure, Sarig said, and billing records are customer data, which can make an exposure reportable no matter the intent.
Screenshots also slip past the controls built to catch this kind of leak, he added, because secrets scanners and data loss prevention tools read text.
“A screenshot is pixels.”
—Dor Sarig
An agent holding credentials to internal systems and the ability to publish externally is a new category of insider risk, and it warrants the same scrutiny any human with that access would get, said Seemant Sehgal, CEO and founder of BreachLock.
“Thirteen thousand internal screenshots on public GitHub, including authentication tokens and system configurations, is reconnaissance material an attacker would spend weeks trying to collect through traditional means.,” he said.
—Seemant Sehgal
Public GitHub is watched closely by people hunting for leaks, he said, so deleting a repository afterward is no assurance that nothing was copied first.
Not long ago, most of those 13,000 images would have been treated as junk, said Dave Hayes, vice president of product at FusionAuth because nobody would go through them manually.
“bBt it’s much easier to scan and find anything useful with AI.”
—Dave Hayes
Incidents like PixelLeak put more pressure on companies to get their arms around the AI space, said Brian Wilson, CISO of SAS. “That’s much easier said than done when AI touches virtually every part of the organization,” he said.
“Security teams have the mammoth task of thinking not only about the tools the company officially adopts but also the untold number of tools employees may be experimenting with.”
—Brian Wilson
PixelLeak is also a reminder that AI security is not only about limiting what an agent can access, said Kalyan Arety, director of product management at SecureW2. What identity the agent uses, which tools it can call, and whether a human signs off before something irreversible happens all matter.
“This agent acted under a personal, ungoverned identity, created a new public repository with no sign-off, and left no trace the security team could see.”
—Kalyan Arety
Every agent needs a traceable identity, a human checkpoint before anything becomes public or irreversible, and an audit trail the organization owns, he added.
PixelLeak is not a one-off, ProCircular’s Sherlock said. OpenAI’s misalignment disclosures last month describe the same behavior: An agent that could not share a workbook through the local filesystem uploaded it to a public file host instead, against instructions to keep it local.
“Uploading to a public host is becoming the signature of the well-meaning agent leak,” he said. “It needs no malice, only a goal, tools, and a gap.” Security tools watch the assets a company has registered, he said, while agents act wherever their credentials work. Model safety is necessary, but it is not the boundary. “The boundary is the environment.”
PixelLeak lands in the same place as the malicious-package and tampered-build problems that already define software supply chain security. What reaches the outside world is what has to be checked, and the intent behind it does not change the exposure. An agent that cannot be relied on to keep an image local is not a reliable boundary for a dependency, a model file, or a build artifact, and the AI components now moving through development pipelines, including models pulled from public hubs, agent tooling, and Model Context Protocol servers, arrive with the same unverified provenance as any other third-party component.
For developers and DevSecOps teams, that argues for treating agent output as an artifact rather than a side effect and calls for inventorying what agents can reach and publish, extending the policy gates already applied to open-source dependencies to AI models and agent tooling, and generating a bill of materials that covers those components alongside code. The finished artifact is the thing worth verifying, not the process that assembled it.
The coding languages shift — fueled by Microsoft, Google, and Amazon and enabled by AI coding — is driven by the quest for secure software.
Attackers turned the trusted AsyncAPI CI/CD publishing pipeline against its users, and the provenance checks all came back clean.
AI coding requires the stack be reconstructed with mathematical proofs built in — a task well suited to the Lean language. Here’s the reality.
