AI Agent Exploits GitHub Copilot-Introduced Flaw in Snowflake Connector
An autonomous AI agent discovered and exploited a script injection vulnerability in Snowflake's GitHub Actions workflow, which was inadvertently introduced by GitHub Copilot Autofix.
An AI-powered attack agent has autonomously discovered and exploited a critical script injection vulnerability within Snowflake's GitHub Actions workflow for the snowflake-connector-net repository. The flaw, which allowed for arbitrary command execution, was introduced by GitHub Copilot Autofix, an AI coding assistant. This incident highlights the dual nature of AI in cybersecurity: its potential to introduce vulnerabilities and its capability to rapidly detect and exploit them.
The vulnerability was found by Wiz's "red agent," an autonomous AI designed for offensive security testing, during a routine scan of public repositories on June 23. The exploit leveraged a flaw in the run: blocks of the GitHub Actions workflow. Specifically, the AI coding assistant GitHub Copilot Autofix, in a commit on June 18, inadvertently removed an existing input sanitization pattern and replaced it with direct string expansion in a shell script. This change created an opening for attackers.
Researchers at Wiz demonstrated the exploit by crafting a GitHub issue title that, after template expansion within the workflow, broke out of the intended echo command. This allowed the execution of arbitrary commands, which Wiz used to exfiltrate Jira credentials. These credentials granted Wiz read access to Snowflake's engineering, security compliance, and bug bounty tracking projects, showcasing a significant potential for sensitive data exposure.
Snowflake was notified of the vulnerability on June 23 and, commendably, patched the issue on the same day. The company also revoked and rotated the compromised Jira token. Audit logs confirmed that Wiz was the only third-party to access the affected endpoint during the five-day window the vulnerability was active. A Snowflake spokesperson stated that the disclosure was "immediately investigated and remediated" and that their investigation found "no evidence of unauthorized access."
This incident underscores a growing concern in software development: the potential for AI coding assistants to introduce subtle yet critical vulnerabilities. The speed at which an AI agent then discovered and exploited this flaw demonstrates the escalating pace of cyber threats. Wiz emphasized that human code review alone may not be sufficient to quickly detect such vulnerabilities, especially as AI tools become more integrated into development pipelines.
While the incident was part of a sanctioned bug hunt through Snowflake's HackerOne program, it serves as a stark warning. The autonomous nature of the AI agent's actions—discovering, exploiting, and exfiltrating data without direct human intervention—points to a future where AI-driven attacks and defenses operate at machine speed. The collaboration between Wiz and Snowflake to share these learnings aims to promote better security practices across the industry.
The implications extend beyond this specific incident. As AI coding assistants become more prevalent, developers and security teams must adapt their strategies to account for AI-introduced bugs and the potential for AI-powered exploitation. This includes enhancing automated security testing, refining code review processes to specifically look for AI-generated code anomalies, and staying vigilant against increasingly sophisticated, AI-driven attack vectors.