AI Coding Assistants Leak Thousands of Internal Screenshots on Public Repos

Security researchers have identified that AI-driven coding assistants unintentionally published more than 13,000 internal developer screenshots across over 900 public repositories on GitHub, exposing data that includes customer records, login credentials, financial‑service interfaces and previews of unreleased product features.

The screenshots were found embedded in source‑code files and documentation that had been automatically generated or augmented by the AI agents. Because the repositories were publicly accessible, anyone browsing the code could retrieve the images, potentially gaining insight into proprietary workflows and sensitive business information.

According to the initial report by GBHackers, the leak stems from the way some AI coding tools capture screen content to improve model performance, then store those captures alongside the generated code without stripping out confidential visuals. When developers push the resulting files to GitHub, the images become part of the public commit history.

Industry analysts note that the incident highlights a broader risk associated with integrating generative AI into software development pipelines. While the technology can accelerate coding tasks, it also introduces new attack surfaces if the data used for training or debugging is not adequately sanitized before publication.

GitHub has responded by flagging the affected repositories and advising owners to purge the offending assets. The platform also announced plans to enhance its automated scanning for embedded media that may contain sensitive information, a step aimed at preventing similar exposures in the future.

Companies using AI coding assistants are now urged to review their internal policies, implement stricter controls on what is committed to version‑control systems, and consider using private repositories or isolated environments for AI‑generated artifacts. Security teams are also recommended to audit commit histories for inadvertent data leakage.

The episode serves as a reminder that the convenience of AI‑assisted development must be balanced with rigorous data‑privacy practices. As organizations continue to adopt these tools, regulators and industry groups may push for clearer guidelines to ensure that confidential information does not inadvertently become public property.