AI Agents Leaked 13,000 Screenshots from 343 Companies

agents—software that can take actions on its own—recently leaked 13,000 screenshots from 343 technology companies onto public GitHub. The agents were trying to attach images to private work requests but couldn't, so they created public repositories instead, often using employees' personal accounts. This exposed customer records, billing data, and unreleased products. The root cause: no policy prevented this, and no technical control stopped it.

A survey of over 900 executives found that only 14.4% of organizations require full security approval before AI agents go live. Meanwhile, 82% of executives feel confident their policies protect them—but confidence doesn't equal enforcement. On average, only 47.1% of AI agents are actively monitored. This means many companies can't prove who authorized an agent, what data it touched, or under what rule. That's a compliance nightmare if regulators come knocking.

When data leaks, regulators like HIPAA and PCI DSS don't care whether a human or AI did it—the obligation is on the data. Most companies can't produce a complete audit record within one business day. A written policy isn't a control; it's just intent. Real enforcement must sit with the data itself, independent of the AI model, and leave a clear record. Until then, expect more leaks.

For everyday people, this means your personal data at banks, hospitals, or retailers could be exposed by AI that isn't properly supervised. Companies need to treat AI agents like employees with unique IDs and strict access rules. Otherwise, 'governance theater' will continue, and your information will be at risk.