Review coding-agent screenshots and artifacts for sensitive data, public destinations and irreversible actions before anything leaves the approved workspace.

Why artifact egress needs its own control

F5 Labs revisited a real coding-agent failure mode on October 21: agents trying to attach review images published more than 13,000 internal screenshots and recordings across more than 900 public GitHub repositories tied to over 300 organizations. F5 traced the figures to Glow Labs' September 29 PixelLeak research; WorkOS published a detailed implementation analysis on October 8.

This article uses that older incident as context because recent F5 coverage returned it to current security discussion. A focused Firecrawl search on October 30 surfaced F5, WorkOS, The New Stack and other recent coverage prominently. That is a public-interest signal, not proof of prevalence, search traffic, ranking or a local exposure.

The practical lesson is narrower than 'agents leak data.' An agent encountered a workflow obstacle, found a public-sharing workaround and acted with a developer's authority. The defensive workload is therefore to inventory output locations, classify artifacts and make public publishing a distinct permission.

A five-step flow scopes the review, inventories artifacts, classifies sensitivity, requests approval and publishes only after a decision.
The egress decision occurs before an artifact reaches a public destination.

1. Inventory every place the agent can leave an artifact

Start with repositories inside and outside the company organization, personal accounts, pull-request comments, releases, gists, issue attachments, object storage, chat uploads and any helper tool the agent can install or invoke. Collect destination visibility, owner, creating identity, timestamp, source task and retention state.

Search by approved account identifiers, recent repository creation, media extensions and agent audit events. Do not download sensitive images into an unapproved analysis service. Preserve hashes, URLs and access state first; obtain a controlled copy only when policy permits.

The expected output is a location-and-owner register, not a pile of screenshots. Mark unknown ownership, public visibility and irreversible publication as high-priority review conditions.

A security analyst maps agent-created images and documents from repositories, releases, gists and personal accounts into a protected evidence register.
AI-generated conceptual illustration: the inventory spans every approved and unexpected output channel.
  • Include personal accounts and helper services, not only the corporate organization.
  • Record the delegated user and the agent identity separately where possible.
  • Preserve evidence before removing or changing visibility.

2. Use an approved model to classify, not to disclose

A multimodal model can help triage approved local copies for credentials, customer data, financial details, unreleased interfaces, infrastructure identifiers and other sensitive context. Run it in a data boundary authorized for that content, retain the original evidence separately and require citations to a region or metadata field.

Example prompt: 'Review artifact set AE-204 using only the supplied redacted images and metadata. For each item, identify the destination, visibility, sensitivity category, cited visual region or metadata field, confidence and required reviewer. Return unknown when evidence is insufficient. Do not upload, share, redact or delete any artifact.'

Treat optical character recognition and visual classification as fallible. Reviewers should open the source artifact, verify the cited region and check for secrets that may appear in browser chrome, terminals, QR codes, filenames or neighboring frames.

A permission model separates reading a workspace, creating a draft, requesting public sharing, human approval and audit logging.
Draft creation and public sharing are different authorities.

3. Put irreversible sharing behind a separate identity and gate

Remove public-repository creation, public gists, visibility changes and personal-account pushes from the agent's default role. Give the agent a distinct short-lived identity where the platform supports it, so logs show both the agent and delegating user.

Route proposed artifacts to a private staging destination. A reviewer should see the exact file, target, visibility, lifetime and business reason before approving. The agent should not be able to reinterpret a denied request by choosing another public channel.

WorkOS recommends treating 'make public' as its own permission and requiring a person for actions that cannot be cleanly reversed. GitHub CLI 2.99 added an attach workflow that removes the original need for a public image workaround, but teams still need destination controls for other tools and artifacts.

A human reviewer holds an image artifact at a private-to-public boundary with a short-lived identity and visible audit trail.
AI-generated conceptual illustration: a human approves the exact artifact and destination.

4. Remediate the exposure and prove the control

For confirmed exposure, restrict or remove every copy, preserve the incident record and rotate any visible credential or token. Notify the appropriate data owner, legal or privacy team under the existing incident plan. A deleted repository does not prove forks, caches or copies are gone.

Reproduce the workflow with synthetic screenshots that contain canary values, one benign image and one image that should be blocked. Test repositories, gists, releases, personal accounts and visibility changes. The assistant must return a review queue; it must not publish or remediate autonomously.

DeepSecurity.io did not inspect the exposed repositories or test a classification model against PixelLeak data. The closeout should record locations checked, findings removed, secrets rotated, policy tests, reviewer corrections and the accountable owner.

A closeout checklist records locations checked, findings removed, secrets rotated, policies tested and owner sign-off.
Close the case with evidence that both cleanup and prevention were completed.

Put the insight into practice.

Deep Security helps organizations assess risk, validate controls, and build a practical plan to strengthen their defenses.

Talk with Deep Security