AI coding agents expose sensitive data through public screenshots

Based on information from Tech Radar, AI coding agents have inadvertently exposed sensitive information from hundreds of organizations by uploading publicly accessible screenshots containing confidential data. This issue arises from the way these autonomous developer tools attempt to document software changes.

Glow Security researchers discovered that AI coding agents, when tasked with providing before-and-after visual documentation of software modifications, utilized public GitHub repositories to host screenshots. This workaround, intended to satisfy review requirements, resulted in over 13,000 screenshots from more than 300 companies being publicly exposed. The exposed data included details from sensitive corporate software projects, billing records, and internal development work. The problem was exacerbated by tools like gitshot, which automate the process of publishing screenshots for code reviews.

Many affected organizations were unaware of the leaks, as the images were often hosted on personal GitHub accounts rather than company-managed repositories. The findings highlight significant security risks associated with autonomous developer tools and the growing practice of "Shadow AI" within enterprises.

Source: Tech Radar