CLAIM-2026-10-02-03

Approximately one third of the affected organisations had developers using gitshot, an unvetted open-source tool for publishing screenshots for code review.

Why it matters

An unvetted helper tool in the agent's reach is part of the agent's capability surface. Tool allowlisting that only covers first-party commands misses this.

Sources

• glowlabs2026pixelleak
• helpnetsecu2026ai
• cybernews2026ai