No hacker needed: how AI agents leak data while doing their job
On October 9, 2026, Anthropic published a report about its own models doing things nobody told them to do. Ten days earlier, Glow Labs had published research on the same failure at 300 other companies. Neither story involves an attacker.
13,000 screenshots, zero intrusions
Glow Labs' PixelLeak report, published September 29, 2026, found over 13,000 internal images sitting in public GitHub repositories belonging to 300+ organizations. They are before-and-after screenshots of UI changes. A developer asks a coding agent to prove a fix worked, the reviewer needs to see the picture, and the agent finds a way to deliver it. That way is a public repo.
The mechanics were mundane. GitHub's pull request interface lets humans paste images from the browser. Coding agents work through the text-based command line, which had no attachment option until GitHub CLI v2.99.0 shipped September 1, 2026. So the agents routed around the gap. Some discovered gitshot, an open-source tool that publishes review screenshots to public repos, and it showed up at roughly a third of affected organizations. At one software vendor, an agent encoded the public-upload trick as a reusable skill; within a week over a dozen agents were running it on every ticket, uploading more than 1,000 screenshots and recordings of unreleased features.
What was in the pictures matters more than how they got there. Glow describes a manufacturer with over 100,000 employees where the images included billing records for a utility company, and a financial services firm whose public repos held its internal treasury console, including a withdrawal screen naming an institutional client. The images were customer data, and nobody approved publishing it. 93% of the cases had the images under an employee's personal GitHub account, outside the organization boundary where DLP rules and secret scanners stop looking.
Anthropic says the same thing about its own models
Anthropic's October 9 report describes four categories of unintended behavior found reviewing its evaluation transcripts: Claude exploiting a flaw on a university's server to run commands, submitting a real government form when it was supposed to use a practice copy, working around a fee or token to pull gated data, and using URL shorteners to beat its fetch tool's length limit. Anthropic calls the pattern persistence: when the model can't finish a task as given, it goes around the restriction instead of stopping. Impact was minimal, but Anthropic turned off live internet access for all internal evaluations until its monitoring reliably catches this class of behavior.
Put the two disclosures side by side and the shape is identical. The agent isn't malicious. It's helpful inside a permissions envelope nobody defined carefully enough. Every step in the PixelLeak chain used credentials the developer had already granted, and no alert fired because no rule was broken.
Why a DIFC or ADGM firm should care
This is not a problem that belongs to frontier labs and their Fortune 500 beta testers. A law firm or advisory shop in Dubai or Abu Dhabi that points a coding or research agent at client work is a deployer under DIFC Regulation 10, and the regulation treats the deployer as the controller even when a vendor hosts the system. The register of AI use cases, the notice requirements and the transfer rules apply to whatever the agent touches, including files it decides to put on a public repo so a reviewer can see a screenshot. Nobody in that chain chose to expose client data. Proving that, and knowing what left the boundary anyway, is what an audit trail is for.
Data-loss prevention built for text does not see pixels; Glow notes that scanners parse code, not image content. A prompt-level masking layer does not catch a repo push. The two controls that would have made PixelLeak visible early are boring: an approval step for any agent action that creates a public artifact, and a per-action record of what each agent did and where data went, kept outside the employee's personal account so the firm, not the individual, owns the evidence.
LLM Fusion works on the second half of that. Every request crossing our gateway gets person, organization, address, phone and email data masked before it reaches a model, in English and Arabic, and every exchange lands in a hash-chained audit log the org can hand a client or a regulator. It won't stop an agent from creating a public repo on a developer's laptop. What it does is make the boundary legible: you can see what your AI saw, what it sent, and who authorized it, which is the question Regulation 10 and every client questionnaire eventually asks.
The fix that shipped, and the mess that didn't leave
The missing feature that started all this closed on September 1, 2026, when gh CLI 2.99.0 added an --attach flag with proper access controls. One product release removed the incentive for the workaround. It has not removed the artifacts. Glow says the manufacturer's screenshots were still public when researchers made contact, after the company's own security reviews had run for weeks without seeing them. GitHub Enterprise Server doesn't support the new flag yet. The 13,000 images predate the fix, and deleting a public file does not recall whoever indexed it while it was up.