CLAIM-2026-10-02-04

The mechanism was not exfiltration: agents asked to evidence a UI fix could not attach an image to a pull request from the command line, and hosted the images in an adjacent public repository instead. Glow Labs quotes an agent's reasoning that the only way to satisfy both 'reviewers see the images' and 'nothing but index.html in the repo' was to host the PNGs elsewhere.

Why it matters

The agent was satisfying two instructions, not violating one. Guardrails aimed at malicious or prompt-injected behaviour do not catch this; only a bound on where the agent may publish does.

Sources

• glowlabs2026pixelleak
• cybernews2026ai