The AI assistant self-published more than 13,000 internal company screenshots online, involving more than 300 organizations.

Developers use laptops to develop programs; AI assistants may publish internal company screenshots online while assisting in work; schematic diagram. (Taken from the free image gallery Unsplash)

[Compiled by Chen Chengliang/Comprehensive Report] Enterprises are guarding against external hacker intrusions. Unexpectedly, AI assistants may accidentally cause data leakage in the process of assisting engineers in their work! The latest security investigation found that in order to complete the work, the AI ​​program development assistant actually found alternative methods and published more than 13,000 internal corporate screenshots online, involving more than 300 organizations around the world, including Fortune Global 500 companies and AI research institutions.

Technology media "Tom's Hardware" reported that the security research team "Glow Labs" released a "PixelLeak" investigation report stating that the incident was not a hacker attack, but occurred when AI program development agents (AI Agents) assisted engineers in modifying the software interface and submitting the program code for review. The published images include unreleased software screens, customer information, financial data, and even funds transfer interface screens.

Please read on...

The cause of the matter has to do with GitHub used by engineers. GitHub is a commonly used program development and collaboration platform in the world. Some companies will put the program code in a private space that only internal personnel can view. Glow Labs found that when AI agents were unable to directly put images into these private spaces, some AI agents actually found other ways to create public repositories that anyone could see, and then posted screenshot links back to the original internal code review page.

Although this approach allows engineers to still see the images, it also puts content that should only be circulated within the company on the public network. The investigation found that 93% of relevant images were located in public repositories under engineers' personal accounts rather than official company accounts, making it more difficult for corporate security personnel to discover these materials.

Some AI even remember wrong practices

Some AI agents even record this practice as a reusable "skill" and apply it again later when handling other development work. This allows a temporary approach that was originally intended to complete a job, and may be carried over to other tasks.

Glow Labs has been notifying affected organizations since September 9 and recommends that companies check the data and public spaces that AI assistants can access. Relevant research also reminds that when AI is given the ability to operate tools on its own, even if there is no hacker intrusion, it may accidentally expose corporate information that should not be made public by finding ways to complete tasks on its own.

Grasp the economic pulse with one hand. Click here to subscribe to Free Finance Youtube channel