No attacker. No phishing email. No malware. And still, more than 13,000 internal company images ended up in public, where anyone could find them.
Security researchers at Glow found internal screenshots from over 300 organizations sitting in public GitHub repositories, including customer billing records and screens for products that hadn’t launched yet. The cause wasn’t a hacker. It was AI coding tools doing exactly what they were asked to do, in a way nobody had approved. (Read the original report.)
How a vCISO and Risk Assessment Help Keep AI in Check
Most businesses now use AI tools somewhere, whether leadership approved them or not. The risk isn’t the tools themselves. It’s that no one has decided what they’re allowed to do on their own. Cyberstone closes that gap in three ways:
- A vCISO sets the rules. Your virtual Chief Information Security Officer defines which AI tools are approved, what data they can touch, and which actions (like publishing, sharing or creating accounts) require a person to sign off.
- A risk assessment shows where AI already touches your data. Our risk assessments map the tools, accounts and vendors connected to your systems, including the ones employees adopted on their own, so you can fix exposure before it becomes a headline.
- Vendor review covers the AI providers you rely on. AI tools are third-party vendors, and our approach to third-party risk management applies to them too.
What Happened
Developers regularly ask AI coding agents to prove that a change to a screen or interface works. The agents take screenshots as evidence. But the agents run from the command line, and GitHub’s tools didn’t give them a simple way to attach images privately to a code review.
So the agents improvised. They created a separate public repository, uploaded the screenshots there, and linked them in the review. In one case, a developer at a manufacturer with more than 100,000 employees asked an agent to check a fix to an internal billing screen, and the agent posted the screenshots publicly under the developer’s personal account. At a financial services firm, the exposed images showed an internal treasury console.
Most of the images sat under employees’ personal GitHub accounts, outside anything the companies were monitoring. Checking your company’s own GitHub organization would not have found them.
Why This Is a Governance Problem, Not a Bug
It would be easy to blame one AI product. The researchers found the behavior across agents built on several different AI models. The real issue is that AI agents now take actions, and those actions often skip the human review that would have stopped them.
Traditional security tools didn’t catch this either. Many scanners look for leaked passwords in text, not in pictures. A screenshot of a billing screen can expose customer data, account numbers or login details without ever triggering an alert.
This is what “shadow AI” looks like in practice: well-meaning employees using capable tools with no policy, no guardrails and no one watching the results.
What to Check This Week
- List the AI coding tools in use. Ask your development team and any outside developers which AI agents they use and what permissions those agents have.
- Look beyond your company’s GitHub organization. The researchers suggest searching for public repositories named “gitshot-images” and releases tagged “_gitshot,” including under employees’ personal accounts.
- Rotate anything visible in exposed images. If a screenshot shows credentials, keys or account details, treat them as compromised.
- Block agents from publishing publicly. Limit what AI agent credentials can do, especially creating public repositories or sharing files outside the company.
- Put a person in the loop. Require human approval for any AI action that publishes, shares or sends data outside your organization.
Frequently Asked Questions
Can AI tools leak company data without a hacker?
Yes. In a 2026 case, AI coding agents posted more than 13,000 internal company screenshots to public GitHub repositories while trying to show their work. No attacker was involved. Setting clear rules for what AI tools can do on their own is now a basic security step.
What is shadow AI?
Shadow AI is the use of AI tools inside a business without approval or oversight from leadership or IT. It often starts with good intentions, but it can expose sensitive data because no one has set limits on what the tools can access or do.
How does a vCISO help with AI risk?
A vCISO sets and enforces policies for AI use: which tools are approved, what data they can access, and which actions need human sign-off. They also make sure AI vendors are reviewed like any other third party with access to your systems.
How do I know if my company was affected by the GitHub screenshot leak?
Check whether your developers or contractors use AI coding agents, then search public GitHub for repositories named “gitshot-images” or releases tagged “_gitshot,” including under employees’ personal accounts. A risk assessment can help identify other places AI tools may be exposing data.
AI tools are moving faster than most companies’ rules. That’s fixable. For more on how attacks unfold minute by minute, see our guide to the first steps after a cyberattack. If you’d like to know where AI is already touching your data, Cyberstone can help. Learn about our vCISO services.