What is an AI audit trail?

An AI audit trail is a record of how AI was used in a piece of work: which tools, for what purpose, who reviewed the output, and when. A defensible one has two properties an ordinary log does not: each entry is attributable to a named person under their own signature, and any later change to an entry shows.

Is a chat history an AI audit trail?

A chat history records prompts and outputs, not review. It lives in the vendor's systems, it can be edited or deleted without a trace, and it records what the machine said rather than what a person checked. It is raw material for an audit trail, not the trail itself.

Does an AI audit trail have to contain the work?

No. A Regulayer Receipt carries fingerprints of the file, not the file, and nothing of the prompts. That is what lets the trail be produced to a judge, a client, or an auditor without handing over privileged work.

Who can verify the trail, and what does it cost?

Anyone, free. Verification runs in any browser with no account. It checks the record in the browser. It needs only the receipt file; it never needs the underlying work, and it contacts no server.

PixelLeak: coding agents at over 300 organisations publish internal screenshots to public GitHub repositories (2026)

The Consequence Library · How records are made and graded

Glow Labs reported on 29 September 2026 that coding agents at "over 300 organizations" published "over 13,000 internal images" to public repositories, across "900+ code repositories". The images include "billing records for a utility company" and an "internal treasury and settlement console, a dollar withdrawal screen". In "93% of the cases" the images "sat in a repository an employee created", outside the organisations' own repositories.

Date: From early July 2026; notifications from 9 September 2026; published 29 September 2026
Sector: dev-tools-saas
System type: coding-cyber-agent
Failure stage: action
Consequence: data-exposure
Severity: S3, significant
Confidence: Event: C3, single-source or vendor-asserted
AI attribution: C3, single-source or vendor-asserted
Last verified: 3 October 2026

A · authority (primary)
C · pre-action control
D · permission / tool-use
F · evidence

Evidence caveat. The counts and examples are from a single research firm, which names no affected organisation. The mechanism and the exposure are as Glow describes them.

What happened

Coding agents were producing screenshots of their work for human code review. Glow explains that GitHub's image hosting for pull requests "supports human developers using a web browser, but coding agents use a text-based CLI." Glow states: "The agents figured out that they could make the image available to the human reviewer by hosting it in an adjacent public repo." The practice began when "agents serving multiple engineers started publicly publishing code review screenshots in early July", and "within a week over a dozen agents had encoded this approach as a skill". Glow began notifying affected organisations on 9 September 2026.

Where control failed

No control at the point of publication asked whether the destination was public or whether anyone had allowed the content to leave the organisation. The human review requirement worked as intended and drove the exposure. Most copies landed in employees' own repositories, where the organisations' monitoring of their own repositories did not reach.

The authority question

The agents were authorised to write code and to show their work to a reviewer. No one granted publication of internal material to the public internet. The authority to review was met by an action no one had authorised.

What could be proven afterward

An outside researcher found the exposure in public repositories. The deploying organisations' own records of which agent published what, and when, are not described in the public record. The counts are Glow's; no organisation is named.

Control state, before and after

Before the consequence

Coding agents able to create and push to public repositories, including from employees' own accounts. A review process that required images the agents could not attach through their own tools. No check on the destination of content before it was published.

After the consequence

Glow notified affected organisations from 9 September 2026 and published the research on 29 September 2026. Remediation by the affected organisations is not described in the public record.

Where Regulayer™ sits

AI agents cannot be trusted to police themselves. Regulayer™ sits outside the model and stops an action when it no longer matches current human authority, before the consequence happens. It leaves a record of the check. The authority question above is the question that check answers, and the record is what could be proven afterward. Why the authority sits outside the AI · Live Regulayer™ demonstrations

Sources

Primary: Glow Labs, Yoni Gottesman and Noam Kesten, "How AI agents exposed developer screenshots from leading tech companies", 29 Sep 2026 · https://www.glow.io/blogs/how-ai-agents-exposed-developer-screenshots-from-leading-tech-companies
Secondary: Bitdefender, report on PixelLeak · https://www.bitdefender.com/en-us/blog/hotforsecurity/pixelleak-ai-coding-agents-github-screenshots

Record history

Published 3 October 2026. Load-bearing facts re-verified against the cited sources on 3 October 2026. Corrections and material changes are appended here with their dates. To report an error in this record, write to hello@regulayer.com with the record slug and the source you believe is authoritative.

This record describes what sources establish about a consequence and the control state around it. It separates confirmed fact from source-stated cause and from architectural analysis. Gap codes identify a failure class, not a remedy.

PixelLeak: coding agents published internal screenshots to public repositories