GitHub Copilot Autofix a injecté une faille de sécurité dans le code de Snowflake – et un agent IA l'a trouvée

Security researchers at Wiz have documented an unusual case of artificial intelligence creating the very vulnerability that another AI system then found and exploited: an automated GitHub Copilot fix introduced a serious script injection flaw into a Snowflake open-source repository, and Wiz's autonomous Red Agent discovered the bug, weaponized it, and pulled credentials from Snowflake's internal systems — all within days of the flawed code landing.

The findings, published Monday on the Wiz Research blog, quickly reached the front page of Hacker News, where developers debated what it means for the growing practice of letting AI coding assistants commit changes directly to production repositories. The episode is being read as a warning shot for the industry's rush toward AI-authored code. For more stories on the tools reshaping software development, follow our AI news coverage.

How an AI Autofix Created a Vulnerability

According to Wiz, the problem began on June 18, 2026, when a pull request in the public `snowflake-connector-net` repository updated a GitHub Actions workflow called `jira_issue.yml`. The commit, co-authored by GitHub Copilot's Autofix feature, replaced a safe coding pattern — one that passed untrusted issue titles through an environment variable and built JSON payloads with `jq` — with direct template interpolation of user-controlled input into a shell script.

The workflow ran whenever any GitHub user opened an issue on the repository. Because the issue title was interpolated directly into a `run:` block, a single quote in a crafted title was enough to break out of the shell command and execute arbitrary code on GitHub's Actions runners.

A conditional check in the workflow that appeared to be a security gate turned out to be ineffective: on issue events, the `github.event.pull_request` context is always null, so the condition evaluated to true for every user. In practice, anyone on GitHub could trigger the workflow.

Wiz says the safe pattern the AI assistant removed had been deliberately implemented to prevent exactly this class of shell injection — a historical context the automated assistant had no way of knowing.

Red Agent Found It — and Refused to Fail

What makes the case remarkable is how the flaw was discovered. Wiz's Red Agent, an autonomous offensive security agent, was scanning Snowflake's GitHub organization with a CI/CD analysis capability when it flagged the workflow as vulnerable to script injection.

When the agent attempted to exploit the flaw, its first payload — which used a comment character to truncate the shell command — failed with a bash syntax error. Rather than stopping, the researchers wrote, Red Agent autonomously analyzed the error, adjusted its payload to properly close the shell syntax, and successfully exfiltrated Jira credentials to an out-of-band callback server. The callback arrived from a GitHub Actions runner, carrying the credentials in base64-encoded form.

The exfiltrated token belonged to an account with read access across Snowflake's engineering, security compliance, and bug bounty tracking projects in Jira.

Five Days From Injection to Patch

The disclosure timeline published by Wiz moves fast:

• June 18, 2026 — the vulnerable pattern is introduced by a commit co-authored by Copilot Autofix

• June 23, 2026 — Wiz identifies, exploits, and reports the flaw to Snowflake via HackerOne

• June 23, 2026 — Snowflake patches the workflow the same day, restoring the safe `env:` variable and `jq` parsing pattern

• June 24, 2026 — the exposed Jira token is revoked and rotated

• July 25, 2026 — coordinated public disclosure

Snowflake told Wiz that its investigation found no evidence of unauthorized access. "The disclosure was received on June 23, 2026, and it was immediately investigated and remediated, and our investigation found no evidence of unauthorized access," the company said in a statement, adding that it is working with Wiz to share the learnings with the broader industry.

The Bigger Lesson: AI Code Needs Human-Grade Scrutiny

Wiz drew three takeaways from the incident, and they extend well beyond Snowflake.

First, AI-generated pull requests must undergo the same static analysis and security review as human code. Coding assistants predict code from probabilistic patterns, which means they can silently reintroduce deprecated or insecure constructs that a repository had already eliminated.

Deuxièmement, les fenêtres de découverte s’effondrent. La vulnérabilité n’a été active que cinq jours avant qu’un agent automatisé ne la trouve et ne la valide – un rythme qui suppose que les attaquants effectuant des analyses avec des outils similaires pourraient agir tout aussi rapidement. Les cycles de correctifs rapides et les informations d’identification de courte durée deviennent des exigences de base.

Troisièmement, les organisations ont besoin de garde-fous qui empêchent les assistants d’IA de remplacer les analyseurs de données structurées par une interpolation directe de chaînes – précisément la régression qui s’est produite ici.

L’incident survient à un moment d’introspection plus large de l’industrie sur le code généré par l’IA. Une série d'études récentes et de cas concrets ont montré que les outils de codage d'IA peuvent en toute confiance introduire des bugs, des failles de sécurité et des problèmes de maintenance parallèlement à leurs gains de productivité. Ce qui rend le cas Snowflake distinctif, c'est la boucle fermée : l'IA qui a causé le problème et celle qui l'a détecté agissaient toutes deux de manière autonome, les humains examinant les conséquences.

Pour les équipes de sécurité, le message de Wiz est direct. La question n’est plus de savoir si le code écrit par l’IA contiendra des vulnérabilités : il s’agit plutôt de savoir si votre pipeline de détection, humain ou automatisé, peut les trouver plus rapidement que l’agent de quelqu’un d’autre.

Gardez une longueur d'avance sur la courbe de l'IA

Les outils de codage d’IA et les agents autonomes modifient la sécurité des logiciels en temps réel. Ajoutez AI Buzz Wire à vos favoris pour obtenir des rapports quotidiens sur l'industrie de l'IA.

Lire plus d'actualités sur l'IA →