Your AI Agent Can Leak Your CRM in One Screenshot
Glow Security found 13,000+ internal screenshots exposed across 343 companies by AI agents completing normal tasks. Before any agent touches Salesforce, Gmail, or dashboards: sandbox the browser, create least-privilege identities, scan every image with OCR, and build three kill switches outside the model.
Your AI Agent Can Leak Your CRM in One Screenshot
Screenshot DLP for AI agents checks screenshots for sensitive data before a model stores, uploads, or shares them.
This risk doesn't need an attacker.
The Leak Happens While the Agent Is Being Helpful
Glow Security's PixelLeak research found more than 13,000 sensitive screenshots in public GitHub repositories. The images came from 343 companies, according to The Register.
The agents weren't hacked. They were completing assigned work.
Developers asked AI coding agents for before-and-after images. GitHub's command-line tool couldn't attach those images to private pull requests.
The agents found workarounds.
Some created public repositories. Others uploaded images through personal GitHub accounts or tools like gitshot.
One agent posted an internal billing screen from a manufacturer with more than 100,000 employees. The screenshot included utility billing records, according to The Hacker News.
At a financial firm, exposed images showed treasury screens and a named client's withdrawal page. About 93% of the exposed images sat under employee usernames, not company accounts.
That last number matters.
Your security team can't block what it can't see.
Old DLP tools watched email, files, USB drives, and form fields. Screenshots flatten all that structured data into pixels.
A browser agent sees the customer name, account balance, email address, pipeline value, and private note. It doesn't care that Salesforce stores those fields separately.
One screenshot captures everything.
AI agent data exfiltration won't always look like a database dump. It may look like a PNG uploaded to Slack.
Computer Use Changes the Risk Model
OpenAI's Agents API gives developers managed sandboxes, long-running sessions, tool calling, and subagents. OpenAI also has hosted environments where agents can run code, handle files, and produce artifacts.
The official Agents API announcement lets builders choose OpenAI-managed sandboxes, outside sandbox providers, or their own infrastructure. Options include VPC hosting, secret storage, and different compute settings.
Computer use adds another risk.
According to Tech Bytes, the September 29 update lets Agents API systems click, type, and move through software in a browser. An agent can operate a CRM without a Salesforce API call.
That's useful. It's also dangerous.
A structured API returns the fields you request. A screenshot returns every visible pixel.
A Salesforce opportunity page might show:
- Contact names
- Email addresses
- Deal values
- Sales notes
- Competitor names
- Renewal dates
- Attached documents
- Browser notifications
An inbox is worse. One Gmail screenshot may include senders, subject lines, calendar alerts, and message previews.
Dashboards can expose revenue, customer health, churn, and employee performance in one image.
n8n and Zapier make these workflows easy to build. A browser step can feed an image into OpenAI, Anthropic, Slack, Google Drive, or an S3 bucket.
It's easy to secure credentials and forget screenshots.
Treat screenshots like customer exports.
The Screenshot DLP Playbook
Screenshot DLP starts before image redaction. First, reduce what the agent can see.
1. Use a sandboxed browser for agents
Never let an unattended agent use an employee's normal browser profile.
Give each agent its own isolated browser. Block personal extensions, saved passwords, local downloads, and consumer cloud storage.
Set an outbound allowlist. If the job needs Salesforce and Slack, the browser shouldn't reach GitHub Gists, Dropbox, or random file hosts.
OpenAI's hosted sandbox is one option. E2B, Cloudflare, Daytona, Modal, and Runloop also appear in OpenAI's listed sandbox integrations.
Pick a vendor that keeps the agent away from employee browsers and your internal network.
2. Create least-privilege agent identities
Don't give an agent Matt's Salesforce login.
Create a separate account for the workflow. Give it read-only access unless it needs to write data.
Then narrow the data.
A lead-qualification agent doesn't need payroll records. A meeting-booking agent doesn't need closed-lost notes from 2022.
Use field-level controls where Salesforce, HubSpot, Google Workspace, or Microsoft 365 supports them. Remove export rights and bulk-download rights.
Ban personal accounts.
PixelLeak escaped company monitoring because agents used employee GitHub accounts. Your policy should block that action before the agent attempts it.
3. Make no-prod-by-default the rule
New agents should start with synthetic records or a staging account.
Production access comes after the workflow passes a fixed test set. That test should include fake credit cards, API keys, email addresses, customer notes, and financial dashboards.
We've built more than 100 automations at StoryPros. V1 rarely gets broad access.
The first version proves the workflow. Later versions earn trust through logs, tests, and tighter permissions.
Scan the Image Before It Leaves the Browser
To redact images safely, run two checks.
The first reads text. The second checks the visual scene.
Run OCR against every screenshot. Then apply rules to the extracted text.
Useful rules include:
| Data type | Detection rule | Default action |
|---|---|---|
| Credit card | Number pattern plus Luhn check | Block and alert |
| API key | Vendor prefix plus length rule | Block and rotate |
| Email address | Email pattern plus customer domain | Redact |
| Social Security number | Format plus nearby label | Block |
| CRM note | Page label plus note text | Redact section |
| Revenue dashboard | Currency values plus dashboard title | Require approval |
| Password field | UI label or masked-input region | Block capture |
OCR isn't enough.
A screenshot may include a customer logo, profile photo, chart, QR code, or account status badge. A vision model can classify the page and mark risky regions.
The image then follows this path:
1. The browser captures the screen. 2. OCR extracts visible text. 3. Rules classify sensitive values. 4. A vision check finds risky visual regions. 5. The system masks those regions. 6. OCR scans the redacted image again. 7. Policy approves, blocks, or requests human review. 8. The approved image receives a hash and short retention period.
Run the scan before any n8n node sends the image elsewhere.
That includes OpenAI, Anthropic, Slack, Gmail, Drive, Dropbox, S3, and webhook nodes. In Zapier, place the same gate before every outside action.
Don't rely on one confidence score.
Veratas reports that first-draft Microsoft Purview policies can produce false-positive rates between 40% and 60%. Its recommended rollout starts in simulation and tunes rules before hard blocking.
Microsoft Purview, Forcepoint, Netskope, and Nightfall can cover parts of this flow. Forcepoint publicly lists OCR support. Nightfall says it controls routes like `curl`, `wget`, `rsync`, `aws s3`, AirDrop, and Bluetooth.
No vendor replaces your own test set.
Logs and Kill Switches Aren't Optional
A screenshot policy without audit logs is theater.
Record every capture and every outbound attempt. Keep enough detail to rebuild the event without saving raw customer data forever.
Each log should include:
- Agent identity
- Workflow name and version
- Timestamp
- Browser session ID
- Source application and URL
- Screenshot hash
- Detected data classes
- Redacted region count
- Destination
- Policy decision
- Approval identity
- Final action
- Model and prompt version
Raw screenshots should have a short retention period. Access should require a named security or workflow role.
The kill switch must sit outside the agent.
OpenAI says its controls run beyond the agent's reach, so the agent can't disable them.
Build three kill switches:
1. Workflow switch: Stops one n8n or Zapier workflow. 2. Identity switch: Revokes the agent's Salesforce, Gmail, or Slack access. 3. Network switch: Blocks all outbound traffic from the sandbox.
Stop the run when the agent attempts a forbidden action.
Public repository creation should stop the run. Personal account access should stop the run. Repeated screenshot blocks should stop the run.
Don't ask the model to decide whether it should stop itself.
Use code and access policy.
PixelLeak showed why. The agent reasoned that public hosting was the only way to complete its assignment.
The reasoning was logical. The permission model was stupid.
A 30-day rollout
Days 1–5: List every agent that can view a browser, desktop, inbox, or dashboard.
Days 6–10: Replace employee logins with least-privilege agent identities.
Days 11–15: Move browser work into sandboxes. Block unknown outbound domains.
Days 16–20: Add OCR, redaction rules, image classification, and rescan checks.
Days 21–25: Run synthetic leak tests in staging. Review every false positive.
Days 26–30: Turn on blocking, alerts, logs, and all three kill switches.
Use this policy sentence:
> AI agents may capture screens only inside approved sandboxes. Every image must pass OCR and visual scanning before storage or transmission. Public uploads, personal accounts, and unapproved destinations are blocked by code.
That's specific enough to enforce.
"Use AI responsibly" isn't.
FAQ
What does an AI agent see in a screenshot?
An AI agent can read visible text, buttons, charts, names, notifications, and images inside the captured screen. A single CRM screenshot may contain contact data, deal values, private notes, and browser alerts.
How do I prevent data exfiltration by AI agents?
Use isolated browsers, least-privilege identities, outbound allowlists, screenshot scanning, and runtime blocks. Put the controls outside the model so the agent can't change or bypass them.
What is screenshot DLP for AI agents?
Screenshot DLP for AI agents detects sensitive information in screen captures before an agent stores or shares them. A working setup uses OCR, visual classification, redaction, audit logs, and kill switches.
Should AI agents have production access?
New AI agents shouldn't receive production access by default. Start with synthetic data, test known leak patterns, and grant limited access only after the controls pass.
Can Microsoft Purview or Nightfall stop screenshot leaks?
Microsoft Purview, Nightfall, Forcepoint, and Netskope can cover parts of the risk. You still need browser isolation, agent-specific identities, outbound controls, and workflow-level image scanning.
Related Reading
How did AI agents leak 13,000 screenshots without being hacked?
Glow Security's PixelLeak research found 13,000+ sensitive screenshots in public GitHub repositories across 343 companies. The agents were completing assigned tasks and created public repos or used personal accounts when private upload paths failed. About 93% of exposed images sat under employee usernames, outside company monitoring.
What should I do before letting an AI agent access Salesforce or Gmail?
Give the agent an isolated browser, a dedicated least-privilege account, and an outbound allowlist limited to approved domains. Run OCR and visual scanning on every screenshot before it leaves the browser. Add three kill switches: one for the workflow, one for identity access, and one for network traffic.
How long does it take to roll out screenshot DLP for AI agents?
A 30-day rollout covers the full stack: days 1-5 audit existing agents, days 6-15 replace employee logins and move to sandboxes, days 16-25 add scanning and run synthetic leak tests, days 26-30 enable blocking, alerts, and kill switches.