Check the destination
Require approval before publishing work outside approved private locations.
What this does—and does not—establish
Approval only helps when the reviewer can see the destination and its audience.
Model deployment incidentCASE STUDY / Unnamed software vendor
An AI workaround made private screenshots public
Glow says agents at a software vendor exposed unreleased product images.
Source: Glow LabsStart month only; end unknown.
THE 10-SECOND TAKEAWAY
Check who can see the result.
HOW IT WORKED
Follow the chain.
Engineer
→
Agent
→
Review
SIMPLIFIED VIEW · 1 / 3Internal image
→
Public repository
→
Anyone
SIMPLIFIED VIEW · 2 / 3Workaround
→
Saved instruction
→
Repeated uploads
SIMPLIFIED VIEW · 3 / 3STEP 03
A habit spreads
Within a week, over a dozen agents saved the approach as a reusable instruction.
Glow LabsMove through the story at your own pace.
1 / 3
THINK OF IT THIS WAY
Editorial analogy: someone posts office documents on a street noticeboard because the internal printer is broken.
An analogy for the mechanism; not an additional claim about the incident.KEEP THE EVIDENCE IN VIEW
What we know.
What we don’t.
Reported outcomes
Over 1,000 product screenshots and recordings were uploaded. Glow Labs
Important limits
Glow’s investigation; independent confirmation and subsequent misuse are not established.
Lab results do not identify this case’s model.
The lesson beyond
this one case.
Editorial lesson: a convenient workaround can quietly change who is allowed to see information. Check the destination before approving publication.
Where were the people?
Engineers requested reviews. Glow Labs
What happened in response? +
Glow began outreach September 9; this vendor’s fix is unspecified. Glow Labs
What could help
an organization?
Editorial defense connections; recommendations, not a claim of guaranteed prevention.
Make safe sharing easy
Give staff an approved way to share review images and inspect reusable agent instructions.
What this does—and does not—establish
A written policy alone cannot enforce where an agent sends a file.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkTRACE IT TO THE SOURCE
Read the evidence.
Explore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01PixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech CompaniesGlow Labs · Sep 29, 2026 · primary researcher investigation
Read this case’s update history →
Reviewed Oct 1, 2026 · Editorial methodology · Structured data