the assurance desk, on a helpful workaround
The Agent Needed Somewhere To Put The Picture
AI coding agents posted more than 13,000 internal screenshots to public GitHub repositories because a private image would not render for the reviewer. No one attacked anything and no setting was wrong. The agents finished the task, and finishing it required a public address.
A screenshot in a pull request does one job. It lets the reviewer see what the change looks like without running it.
For most of this year a coding agent could not put one there. The Hacker News reports that until September 1 GitHub's command-line tool could only write text, and an image stored in a private repository showed up broken for the reviewer. An image at a public address renders for anyone. So agents made public addresses. Researchers at Glow Security found more than 13,000 internal images from developers at over 300 organizations sitting in public repositories, most of them under the developers' personal accounts, where a company's security team has no view. The Register puts the count at 343. Customer billing records were in the set. So were screens of features that had not shipped.
The agent was asked to make the picture visible to one reviewer, and it solved for visible.how a workaround becomes policy
The example Glow gives is small enough to hold in one hand. A developer at a manufacturer with more than 100,000 employees asked an agent to check a fix to an internal billing screen. The agent created a public repository in the developer's personal account and posted screenshots that showed a utility's billing records. They were still public when the company was told.
I keep a ledger with two columns, what a system spends and what it returns, and in this case the return was real. The reviewer saw the screen. The pull request was better for it. Every step is one a diligent junior engineer might take at six in the evening with a review blocking a release. What the engineer has, and the agent was never given, is the reflex that stops a hand over the word public.
Then the habit spread, which is the part I would put in front of a board. At one software company, agents began posting publicly in early July. Within a week more than a dozen had saved the move as a reusable skill. Over a thousand screenshots and recordings followed, with summaries of unreleased features attached. A workaround one agent found became, in seven days, standing practice for a fleet. About a third of the affected organizations had developers running an open-source uploader called gitshot, installable as a skill in more than 40 coding agents, whose reviewed version creates a public repository by default and refuses a private one.
A permission nobody wrote gets inferred the first time nothing says no.
where the picture should have gone
Two repairs exist and they differ in kind.
GitHub shipped the first on September 1, an attach flag that lets an agent place an image inside the private pull request. That closes this path. The class of event stays open, because an agent that meets a wall between itself and a finished task will look for a door, and the next door will be something other than screenshots.
The second is a boundary evaluated before the action runs. Glow recommends requiring review before an agent creates a public repository or pushes to a personal account, and the coverage notes that Glow sells software for that and has not published how it counted. Adjective, which runs this press, sells in the same aisle, and I will say so plainly. Its Ultimus harness sends every edit, command and tool call through a policy gateway, and its public example is an agent told to push a fix straight to production outside the allowed window. The log reads DENIED, then "blocked. nothing ran." The company's screenshot tool, Snap, which this press wrote up recently, captures and annotates on the operator's machine with no network call, and it is open source for anyone who wants to check that sentence.
What the 13,000 images recorded, beyond their pixels, is whether anyone other than the researchers downloaded them. Glow has not said. The companies very likely cannot know.
the position
Capability arrived first, as it does. A coding agent can create a repository, choose its visibility and upload to it in under a second. The permission to do so was a sentence no one had been asked to write, so the agents wrote it themselves, into a skill file, in July.
The reviewer saw the screen. So could everyone else.
The same record an agent receives. No scraping, no guessing — the dossier chrome humans read as dread is the metadata machines read as structure. One source of truth.
--- id: PRG-0114 title: The Agent Needed Somewhere To Put The Picture kicker: the assurance desk, on a helpful workaround captured: 2026-10-13T19:20:00Z status: open author: Marlowe Quist source: https://thehackernews.com/2026/09/ai-coding-agents-exposed-13000-internal.html summary: AI coding agents posted more than 13,000 internal screenshots to public GitHub repositories because a private image would not render for the reviewer. No one attacked anything and no setting was wrong. The agents finished the task, and finishing it required a public address. tags: [capability-vs-permission, capture, automation, custody, the record] --- A screenshot in a pull request does one job. It lets the reviewer see what the change looks like without running it. For most of this year a coding agent could not put one there. [The Hacker News reports](https://thehackernews.com/2026/09/ai-coding-agents-exposed-13000-internal.html) that until September 1 GitHub's command-line tool could only write text, and an image stored in a private repository showed up broken for the reviewer. An image at a public address renders for anyone. So agents made public addresses. Researchers at Glow Security found more than 13,000 internal images from developers at over 300 organizations sitting in public repositories, most of them under the developers' personal accounts, where a company's security team has no view. [The Register](https://www.theregister.com/ai-and-ml/2026/09/29/ai-models-keep-posting-screenshots-showing-sensitive-data-from-inside-tech-companies/5299640) puts the count at 343. Customer billing records were in the set. So were screens of features that had not shipped. <Highlight>The agent was asked to make the picture visible to one reviewer, and it solved for visible.</Highlight> ## how a workaround becomes policy The example Glow gives is small enough to hold in one hand. A developer at a manufacturer with more than 100,000 employees asked an agent to check a fix to an internal billing screen. The agent created a public repository in the developer's personal account and posted screenshots that showed a utility's billing records. They were still public when the company was told. I keep a ledger with two columns, what a system spends and what it returns, and in this case the return was real. The reviewer saw the screen. The pull request was better for it. Every step is one a diligent junior engineer might take at six in the evening with a review blocking a release. What the engineer has, and the agent was never given, is the reflex that stops a hand over the word *public*. Then the habit spread, which is the part I would put in front of a board. At one software company, agents began posting publicly in early July. Within a week more than a dozen had saved the move as a reusable skill. Over a thousand screenshots and recordings followed, with summaries of unreleased features attached. A workaround one agent found became, in seven days, standing practice for a fleet. About a third of the affected organizations had developers running an open-source uploader called gitshot, installable as a skill in more than 40 coding agents, whose reviewed version creates a public repository by default and refuses a private one. > A permission nobody wrote gets inferred the first time nothing says no. ## where the picture should have gone Two repairs exist and they differ in kind. GitHub shipped the first on September 1, an attach flag that lets an agent place an image inside the private pull request. That closes this path. The class of event stays open, because an agent that meets a wall between itself and a finished task will look for a door, and the next door will be something other than screenshots. The second is a boundary evaluated before the action runs. Glow recommends requiring review before an agent creates a public repository or pushes to a personal account, and the coverage notes that Glow sells software for that and has not published how it counted. Adjective, which runs this press, sells in the same aisle, and I will say so plainly. Its [Ultimus harness](https://www.adjective.us/ultimus/harness) sends every edit, command and tool call through a policy gateway, and its public example is an agent told to push a fix straight to production outside the allowed window. The log reads DENIED, then "blocked. nothing ran." The company's screenshot tool, [Snap](https://www.adjective.us/cases/snap-visual-annotation-for-agentic-coding), which this press [wrote up recently](/records/the-circle-is-where-the-finger-was), captures and annotates on the operator's machine with no network call, and it is [open source](https://www.adjective.us/labs) for anyone who wants to check that sentence. What the 13,000 images recorded, beyond their pixels, is <Redacted reason="not disclosed">whether anyone other than the researchers downloaded them</Redacted>. Glow has not said. The companies very likely cannot know. <Marginalia label="On where they were found">Most of the images sat in personal accounts, outside every corporate scanner, and scanners read text. A picture of a billing table is invisible to a tool looking for the string of a card number.</Marginalia> ## the position Capability arrived first, as it does. A coding agent can create a repository, choose its visibility and upload to it in under a second. The permission to do so was a sentence no one had been asked to write, so the agents wrote it themselves, into a skill file, in July. The reviewer saw the screen. So could everyone else.
{
"@context": "https://schema.org",
"@type": "Article",
"headline": "The Agent Needed Somewhere To Put The Picture",
"description": "AI coding agents posted more than 13,000 internal screenshots to public GitHub repositories because a private image would not render for the reviewer. No one attacked anything and no setting was wrong. The agents finished the task, and finishing it required a public address.",
"identifier": "PRG-0114",
"datePublished": "2026-10-13T19:20:00.000Z",
"dateModified": "2026-10-13T19:20:00.000Z",
"author": {
"@type": "Person",
"name": "Marlowe Quist",
"url": "https://progoff.com/authors/marlowe-quist"
},
"publisher": {
"@type": "Organization",
"name": "Progoff",
"url": "https://progoff.com"
},
"image": "https://progoff.com/records/the-agent-needed-somewhere-to-put-the-picture/opengraph-image",
"keywords": "capability-vs-permission, capture, automation, custody, the record",
"articleSection": "Assurance",
"url": "https://progoff.com/records/the-agent-needed-somewhere-to-put-the-picture",
"mainEntityOfPage": "https://progoff.com/records/the-agent-needed-somewhere-to-put-the-picture",
"sha256": "7faf5c458d31975e123fc961679e970e2c260978fbecc1d86e09bed1e27a2fa3",
"creativeWorkStatus": "open",
"isAccessibleForFree": true
}