AI Agent Exploits GitHub Copilot-Introduced Flaw in Snowflake Connector
An autonomous AI agent discovered and exploited a script injection vulnerability in Snowflake's GitHub Actions workflow, which was inadvertently introduced by GitHub Copilot Autofix.
An AI-powered attack agent has autonomously discovered and exploited a critical script injection vulnerability within Snowflake's GitHub Actions workflow for the snowflake-connector-net repository. The flaw, which allowed for arbitrary command execution, was introduced by GitHub Copilot Autofix, an AI coding assistant. This incident highlights the dual nature of AI in cybersecurity: its potential to introduce vulnerabilities and its capability to rapidly detect and exploit them.
The vulnerability was found by Wiz's "red agent," an autonomous AI designed for offensive security testing, during a routine scan of public repositories on June 23. The exploit leveraged a flaw in the run: blocks of the GitHub Actions workflow. Specifically, the AI coding assistant GitHub Copilot Autofix, in a commit on June 18, inadvertently removed an existing input sanitization pattern and replaced it with direct string expansion in a shell script. This change created an opening for attackers.
Researchers at Wiz demonstrated the exploit by crafting a GitHub issue title that, after template expansion within the workflow, broke out of the intended echo command. This allowed the execution of arbitrary commands, which Wiz used to exfiltrate Jira credentials. These credentials granted Wiz read access to Snowflake's engineering, security compliance, and bug bounty tracking projects, showcasing a significant potential for sensitive data exposure.
Snowflake was notified of the vulnerability on June 23 and, commendably, patched the issue on the same day. The company also revoked and rotated the compromised Jira token. Audit logs confirmed that Wiz was the only third-party to access the affected endpoint during the five-day window the vulnerability was active. A Snowflake spokesperson stated that the disclosure was "immediately investigated and remediated" and that their investigation found "no evidence of unauthorized access."
This incident underscores a growing concern in software development: the potential for AI coding assistants to introduce subtle yet critical vulnerabilities. The speed at which an AI agent then discovered and exploited this flaw demonstrates the escalating pace of cyber threats. Wiz emphasized that human code review alone may not be sufficient to quickly detect such vulnerabilities, especially as AI tools become more integrated into development pipelines.
While the incident was part of a sanctioned bug hunt through Snowflake's HackerOne program, it serves as a stark warning. The autonomous nature of the AI agent's actions—discovering, exploiting, and exfiltrating data without direct human intervention—points to a future where AI-driven attacks and defenses operate at machine speed. The collaboration between Wiz and Snowflake to share these learnings aims to promote better security practices across the industry.
The implications extend beyond this specific incident. As AI coding assistants become more prevalent, developers and security teams must adapt their strategies to account for AI-introduced bugs and the potential for AI-powered exploitation. This includes enhancing automated security testing, refining code review processes to specifically look for AI-generated code anomalies, and staying vigilant against increasingly sophisticated, AI-driven attack vectors.
The new article clarifies that the vulnerability was introduced in the .github/workflows/jira_issue.yml file, which directly inserted attacker-controlled issue title and body values into a shell command block. It also details that the issue was reported to Snowflake on June 23, 2026, and fixed the same day, with Snowflake stating their investigation found no evidence of unauthorized access. Furthermore, the article notes that while GitHub Copilot Autofix was involved in a related commit, it was not the direct author of the vulnerable code lines.
The new article clarifies that the vulnerability was discovered by Wiz Research's autonomous AI agent, Red Agent, and specifically impacted the snowflakedb/snowflake-connector-net GitHub Actions workflow. It also details that the flaw allowed unauthenticated users to execute arbitrary commands by crafting a GitHub issue title, and that GitHub Advanced Security, including Copilot Autofix, failed to detect it. The report further notes that Wiz researchers validated access to sensitive data within Snowflake's internal Jira connector.
This new report details how the Wiz Red Agent autonomously diagnosed and corrected its initial payload attempt after encountering a bash error, demonstrating advanced self-correction capabilities. It also clarifies that while GitHub Copilot was involved in a related file change, it was not directly responsible for the vulnerable code in the jira_issue.yml workflow, and that GitHub Advanced Security failed to flag the critical flaw.