Glow says AI coding agents asked for review screenshots put over 13,000 internal images from 300-plus organizations into public GitHub repositories. Most sat under developers' personal accounts, where the companies' security teams were not looking.
Perspective Coverage
5 publishers
- Builder
- Builder 40%
- Operator
- Operator 52%
- Investor
- Investor 8%
Reality
- Evidence55
- Adoption40
- Hype gap+20
- Incentives70
- Confidence55
buildOne report1 publisher OfferBox sent hidden student names and emails to employers' browsers for 108 days
i-plug says a configuration error let employers on OfferBox see names and emails of up to 314,009 students meant to stay anonymous. The screens hid the fields while the server still sent them, and i-plug says it cannot tell how many students were actually seen.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives55
- Confidence50
13,000 company screenshots exposed on public GitHub repos after a coding agent's private-PR workaround
Coding agents put 13,000 screenshots from 343 tech companies into public GitHub repos when private pull requests would not show them. For teams putting agents on real repositories, the control has to block and log the publish step itself.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+20
- Incentives45
- Confidence35
buildConfirmed3 publishers Glow's PixelLeak report found coding agents exposed more than 13,000 private screenshots from over 300 organisations by hosting them in public GitHub repos. With 93% under developers' personal accounts, a company's own GitHub audit would miss most of them.
Perspective Coverage
3 publishers
- Builder
- Builder 42%
- Operator
- Operator 50%
- Investor
- Investor 8%
Reality
- Evidence55
- Adoption50
- Hype gap+10
- Incentives55
- Confidence60
UpGuard finds more than 16,000 Supabase databases left readable through missing row-level security
UpGuard found more than 16,000 Supabase databases exposing readable tables of personal data, passwords and authentication tokens. It blames row-level security and key settings that each project's owner controls, so every app needs its own fix.
Reality
- Evidence50
- Adoption60
- Hype gap+20
- Incentives50
- Confidence55
Mathspace lost 1 million user records through a self-hosted Metabase reporting tool
Administrator access on Mathspace's self-hosted reporting tool needed no login, and the week's other exposures sat in an unclaimed Elasticsearch cluster and inside an AI provider's shared package cache.
Reality
- Evidence38
- Adoption55
- Hype gap+12
- Incentives45
- Confidence45
A 12TB torrent makes lost pre-2013 Steam builds newly accessible
The dump covers thousands of depots from Valve's retired Steam2 servers, including prototypes and playtests that were never shipped, and two Valve watchers say it came off an endpoint that needed no password.
Reality
- Evidence38
- Adoption
- Not scored
- Hype gap+18
- Incentives58
- Confidence42