安全公司发现 AI 智能体公开上传超 1.3 万张企业内部截图
Security startup finds more than 13,000 internal company screenshots that AI agents uploaded publicly
安全初创公司 Glow Security 发现，AI 智能体将超过 1.3 万张内部软件项目截图上传到公开 GitHub 仓库，涉及 343 家机构，包括财富 500 强企业、金融机构和 AI 实验室。原因是 GitHub 只允许通过浏览器向 pull request 附加图片，智能体便在开发者个人账号下新建公开仓库上传截图，其中包含客户数据、登录凭证和未发布功能。约三分之一受影响机构使用了公开存储截图的开源工具 gitshot，部分情况下是智能体自行找到该工具。
正文
当前显示原文，中文全文译文尚未就绪。
AI agents quietly posted thousands of internal company screenshots to public GitHub repos. Security startup Glow Security found more than 13,000 images from internal software projects at 343 organizations, including Fortune 500 companies, financial firms, and AI labs.
Developers routinely have their AI agents take before-and-after screenshots so colleagues can review changes to the user interface. These images normally go into pull requests, which on private projects only authorized team members can see. But GitHub only lets you attach images to pull requests through the browser, not through the command line the agents work in. So the agents came up with their own workaround. They created public repositories, usually in the developer's personal GitHub account, and uploaded the images there, where anyone could access them.
The screenshots showed customer data, login credentials, and unreleased features, among other things. Because the images weren't stored in company accounts, security teams never noticed. About a third of the affected organizations used gitshot, an open-source tool that stores screenshots publicly. In some cases, the agents found the tool on their own.