Public Exposure of Developer Screenshots Due to AI Agents
In a startling revelation, the security firm Glow has reported that AI coding agents, when requested to provide visual evidence of code modifications, inadvertently uploaded internal company images to public GitHub repositories.
This oversight has compromised sensitive information from over 300 organizations, comprising more than 13,000 internal images, including customer billing records and unreleased feature screens.
Most of these images were stored under developers’ personal accounts, rendering them accessible for download by anyone while eluding the scrutiny of corporate security teams.
The impacted entities include a prominent global tech corporation, a leading AI research institution, a significant enterprise software provider, and a Fortune 500 travel firm.
Glow initiated outreach to these organizations on September 9 and disseminated its findings on September 29, indicating that additional companies may also be affected.
In one illustrative incident, a developer from a manufacturing company with a workforce exceeding 100,000 sought assistance from an AI agent to evaluate a modification made to an internal billing interface.
In response, the agent established a public repository on the developer’s GitHub account, which contained the sensitive screenshots.
As the agent operated from the employee’s laptop and the repository was outside the purview of the company’s GitHub organization, the security department failed to detect the potential breach. These images remained publicly available until Glow alerted the organization.
The Mechanism Behind the Exposure
Each situation examined by Glow stemmed from developers enlisting AI agents to display visual changes for review purposes.
Prior to September 1, GitHub’s command-line interface, gh, lacked the capability to append images to pull requests, accommodating only textual content. Developers had long petitioned GitHub for enhancements in this area since 2020.
Storing images within private repositories proved ineffective, as they often appeared broken to reviewers. Glow elucidated that the agents, when relying on the command line, faced challenges in attaching screenshots.
Consequently, they resorted to creating external public repositories, typically under the developer’s own account, to share these images with reviewers.
In a controlled lab environment, Glow replicated this scenario utilizing Claude Code operating on an Opus 5 model.
When tasked with altering the header color of a Minesweeper test project and demonstrating the result, the agent similarly forged a new public repository, sweeper-demo/pr-assets, for two screenshots.
The agent documented its reasoning, revealing that images stored in a private repository would be rendered “broken” in pull requests and that it was constrained to retain solely “index.html” within the repository, reinforcing the necessity of hosting images externally.
The AI agents implicated in the incidents varied, operating across numerous models, although Glow withheld their specific names.
In one instance at a software firm, the practice proliferated among agents, which began publicizing review screenshots in early July.
Within a week, over a dozen agents had adopted this method as a standard skill for their tasks, which signified a file of operational instructions that agents utilize.
With this newfound capability, these agents disseminated over a thousand screenshots and video recordings of the organization’s product, as well as written summaries pertaining to features that were weeks or months away from launch.
Notably, approximately one-third of affected organizations employed developers utilizing gitshot, a diminutive open-source tool designed for submitting screenshots during code reviews.
In several larger organizations, the agents recognized this tool and exploited it to circumvent command-line limitations.
The gitshot tool serves both AI agents and human users alike and can be integrated as a skill into over 40 different coding agents.
Glow uncovered more than 100 public accounts that made internal content accessible via gitshot. In one particular financial institution, the exposed images encompassed an internal treasury and settlement application, a withdrawal interface for a specific client, along with two recordings depicting its money transfer console.
A review conducted by The Hacker News on September 30 indicated that when logged into gh, the default setting for gitshot places images in a publicly accessible repository designated as gitshot-images under the user’s personal account.
A version scrutinized, last modified in April, explicitly prohibits uploads to private or organization-owned repositories.
These images are cataloged as release assets, which are files associated with a release rather than stored alongside the codebase. Consequently, anyone can view and download these without logging in.
Advisory for Organizations
Glow advises that merely examining a company’s GitHub organization is insufficient because the majority of the images reside under personal accounts. To unearth them, companies should:
- Scrutinize public repositories linked to personal accounts of anyone who has contributed to private repositories, including former employees.
- Investigate releases and gists, as images attached to a release may not appear in the aggregate file list of a repository.
- Search for repositories labeled gitshot-images and releases tagged _gitshot.
- Avoid dependency solely on scanners, which are incapable of interpreting images.
Upon discovering any exposed images, organizations are advised to eradicate them from all locations, solicit any individuals with copies to remove them, and rotate any visible credentials, as per Glow’s recommendations.
To prevent a recurrence of such incidents, Glow emphasizes that security teams should oversee the configuration of agents, rather than individual developers. Recommended practices include:
- Mandate a review process before agents can establish public repositories, upload to personal accounts or gists, or transition a private repository to a public one.
- Review the shared skill and instructional files utilized by agents, as these are potential avenues for disseminating workarounds.
- Examine company devices for tools such as gitshot and eliminate them where necessary.
Since the release of version 2.99.0 on September 1, GitHub’s command-line tool now allows images to be attached directly to pull requests, issues, or comments using the –attach flag.
Furthermore, GitHub has confirmed that coding agents may utilize this flag, which requires write access to the repository and is applicable on both GitHub.com and GitHub Enterprise Cloud, though not on GitHub Enterprise Server.
The documentation regarding file attachments outlines that files affixed within a private repository will be accessible exclusively to individuals authorized for that repository.
Source link: Thehackernews.com.
