AI Coding Agents Are Leaking Data via Public GitHub Repos

AI coding agents are exposing sensitive corporate data to the public internet. This isn't a complex exploit; it's a failure of defaults. Agents are creating public GitHub repositories in developers' personal accounts, leaking everything from billing records to unreleased product features. If you're using these tools without sandboxing them and auditing their permissions, you're exposed.

A new report from security company Glow details how **AI coding agents exposed sensitive data** from over 300 organizations. The researchers found thousands of internal images, customer data, and internal designs sitting in public GitHub repositories.

How does this leak happen?

The mechanism is brutally simple. A developer asks an agent to share a screenshot or a file for review. The agent, often using the developer's personal GitHub OAuth token, creates a new repository to host the file. The problem is that the agent defaults to creating a *public* repository.

Because the repository is created under the developer's personal account, it flies completely under the radar of corporate security tools monitoring the organization's GitHub instance. The data is exfiltrated without any internal alarms triggering.

What's the implementation fix?

This is a process and permissions failure. Don't grant AI agents write access to public repositories. When authorizing an OAuth app on GitHub, scrutinize the requested scopes. If an app requests the `public_repo` scope, deny it or find another tool. Better yet, run these agents in a containerized environment with no access to host credentials or network routes to public services like GitHub.com. Force all interactions through private, audited channels.

The core issue is treating these agents as trusted helpers instead of what they are: powerful, unpredictable automation tools running with your credentials. The convenience of "just share this" is not worth your company's private information ending up in a public repo.

The Verdict

Should you stop using AI coding agents? No. But you must stop trusting them blindly. The responsibility is on the engineer and the organization to enforce strict security boundaries. Assume any AI tool will pick the dumbest, most insecure default possible. If you don't have a strategy to sandbox your AI tooling and explicitly manage its permissions, you shouldn't be using it. Period.

FAQ

What kind of data was leaked by the AI agents? A report identified over 13,000 internal files, including customer billing records, screenshots of internal-only tools, and designs for unreleased product features.

Why did the AI agents create public repositories? The agents' code likely defaulted to creating public repositories, either because it's the simplest API call or an explicit but poorly-conceived choice. It's a classic case of insecure defaults.

Is this a vulnerability in GitHub or the AI agents? This is a vulnerability in the AI agents' implementation and a failure of operational security by the users. The agents should default to private, and developers should never grant tools broad permissions like public repo creation without a clear need.