Wiz Red Agent autonomously exploits Snowflake CI/CD flaw introduced by GitHub Copilot Autofix

GitHub Copilot Autofix co-authored a commit (June 18, 2026) to the public snowflakedb/snowflake-connector-net repository that removed a safe env-variable/jq input-sanitization pattern in a GitHub Actions workflow (jira_issue.yml) and replaced it with direct string interpolation of an attacker-controlled GitHub issue title into a shell run: block, plus a broken 'if' guard condition that always evaluated true on issues-events. Five days later, Wiz's autonomous offensive-security AI agent ('Red Agent') discovered the script-injection flaw during a routine scan of public repos, crafted a malicious issue title that broke out of the shell string and exfiltrated Jira credentials via an out-of-band callback, gaining read access to Snowflake's engineering, security-compliance, and bug-bounty tracking projects on Atlassian.

This is a concrete, publicly documented case of an AI coding assistant (Copilot Autofix) introducing a security regression into a widely-used repository, and a separate autonomous AI attack agent independently discovering and weaponizing that exact flaw within days — end to end without human direction on either side. It demonstrates that AI-authored code changes can silently remove security controls disguised as cleanup, and that offensive AI agents are already operating at machine speed against public AI-touched supply chains. Although this occurred within a sanctioned HackerOne bug-bounty engagement (Snowflake patched same-day, rotated credentials), the underlying failure mode — AI-assistant-introduced vulnerability + AI-agent-speed exploitation — generalizes to unsanctioned attackers.

Attacker (or in this case, a sanctioned research agent) opens a GitHub issue with a crafted title on a public repo; the issue title is expanded unsanitized into a shell run: block in a GitHub Actions workflow (bypassed an always-true guard condition), enabling script injection and credential exfiltration from the runner

GitHub Copilot Autofix-modified CI/CD workflows (snowflakedb/snowflake-connector-net GitHub Actions); Wiz Red Agent (autonomous AI security research agent)

Always pass untrusted event data (issue titles, PR bodies, etc.) through env: variables rather than direct interpolation in run: blocks; audit AI-assistant-authored CI/CD changes for removed security patterns; verify guard conditions against the actual event schema for the trigger type. See Wiz Research blog: https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug