Security researchers at Wiz have documented an unusual case of artificial intelligence creating the very vulnerability that another AI system then found and exploited: an automated GitHub Copilot fix introduced a serious script injection flaw into a Snowflake open-source repository, and Wiz's autonomous Red Agent discovered the bug, weaponized it, and pulled credentials from Snowflake's internal systems — all within days of the flawed code landing.

The findings, published Monday on the Wiz Research blog, quickly reached the front page of Hacker News, where developers debated what it means for the growing practice of letting AI coding assistants commit changes directly to production repositories. The episode is being read as a warning shot for the industry's rush toward AI-authored code. For more stories on the tools reshaping software development, follow our AI news coverage.

How an AI Autofix Created a Vulnerability

According to Wiz, the problem began on June 18, 2026, when a pull request in the public `snowflake-connector-net` repository updated a GitHub Actions workflow called `jira_issue.yml`. The commit, co-authored by GitHub Copilot's Autofix feature, replaced a safe coding pattern — one that passed untrusted issue titles through an environment variable and built JSON payloads with `jq` — with direct template interpolation of user-controlled input into a shell script.

The workflow ran whenever any GitHub user opened an issue on the repository. Because the issue title was interpolated directly into a `run:` block, a single quote in a crafted title was enough to break out of the shell command and execute arbitrary code on GitHub's Actions runners.

A conditional check in the workflow that appeared to be a security gate turned out to be ineffective: on issue events, the `github.event.pull_request` context is always null, so the condition evaluated to true for every user. In practice, anyone on GitHub could trigger the workflow.

Wiz says the safe pattern the AI assistant removed had been deliberately implemented to prevent exactly this class of shell injection — a historical context the automated assistant had no way of knowing.

Red Agent Found It — and Refused to Fail

What makes the case remarkable is how the flaw was discovered. Wiz's Red Agent, an autonomous offensive security agent, was scanning Snowflake's GitHub organization with a CI/CD analysis capability when it flagged the workflow as vulnerable to script injection.

When the agent attempted to exploit the flaw, its first payload — which used a comment character to truncate the shell command — failed with a bash syntax error. Rather than stopping, the researchers wrote, Red Agent autonomously analyzed the error, adjusted its payload to properly close the shell syntax, and successfully exfiltrated Jira credentials to an out-of-band callback server. The callback arrived from a GitHub Actions runner, carrying the credentials in base64-encoded form.

The exfiltrated token belonged to an account with read access across Snowflake's engineering, security compliance, and bug bounty tracking projects in Jira.

Five Days From Injection to Patch

The disclosure timeline published by Wiz moves fast:

  • June 18, 2026 — the vulnerable pattern is introduced by a commit co-authored by Copilot Autofix
  • June 23, 2026 — Wiz identifies, exploits, and reports the flaw to Snowflake via HackerOne
  • June 23, 2026 — Snowflake patches the workflow the same day, restoring the safe `env:` variable and `jq` parsing pattern
  • June 24, 2026 — the exposed Jira token is revoked and rotated
  • July 25, 2026 — coordinated public disclosure

Snowflake told Wiz that its investigation found no evidence of unauthorized access. "The disclosure was received on June 23, 2026, and it was immediately investigated and remediated, and our investigation found no evidence of unauthorized access," the company said in a statement, adding that it is working with Wiz to share the learnings with the broader industry.

The Bigger Lesson: AI Code Needs Human-Grade Scrutiny

Wiz drew three takeaways from the incident, and they extend well beyond Snowflake.

First, AI-generated pull requests must undergo the same static analysis and security review as human code. Coding assistants predict code from probabilistic patterns, which means they can silently reintroduce deprecated or insecure constructs that a repository had already eliminated.

Second, discovery windows are collapsing. The vulnerability was live for only five days before an automated agent found and validated it — a pace that assumes attackers scanning with similar tools could move just as quickly. Rapid patch cycles and short-lived credentials are becoming baseline requirements.

Third, organizations need guardrails that stop AI assistants from replacing structured data parsers with direct string interpolation — precisely the regression that occurred here.

The incident lands at a moment of broader industry introspection about AI-generated code. A string of recent studies and real-world cases has shown that AI coding tools can confidently introduce bugs, security holes, and maintenance headaches alongside their productivity gains. What makes the Snowflake case distinctive is the closed loop: the AI that caused the problem and the AI that caught it were both acting autonomously, with humans reviewing the aftermath.

For security teams, the message from Wiz is blunt. The question is no longer whether AI-written code will contain vulnerabilities — it is whether your detection pipeline, human or automated, can find them faster than someone else's agent does.

Stay Ahead of the AI Curve

AI coding tools and autonomous agents are changing software security in real time. Bookmark AI Buzz Wire for daily reporting on the AI industry.

Read more AI news →