Security researchers at Wiz have documented an unusual case of artificial intelligence creating the very vulnerability that another AI system then found and exploited: an automated GitHub Copilot fix introduced a serious script injection flaw into a Snowflake open-source repository, and Wiz's autonomous Red Agent discovered the bug, weaponized it, and pulled credentials from Snowflake's internal systems — all within days of the flawed code landing.

The findings, published Monday on the Wiz Research blog, quickly reached the front page of Hacker News, where developers debated what it means for the growing practice of letting AI coding assistants commit changes directly to production repositories. The episode is being read as a warning shot for the industry's rush toward AI-authored code. For more stories on the tools reshaping software development, follow our AI news coverage.

How an AI Autofix Created a Vulnerability

According to Wiz, the problem began on June 18, 2026, when a pull request in the public `snowflake-connector-net` repository updated a GitHub Actions workflow called `jira_issue.yml`. The commit, co-authored by GitHub Copilot's Autofix feature, replaced a safe coding pattern — one that passed untrusted issue titles through an environment variable and built JSON payloads with `jq` — with direct template interpolation of user-controlled input into a shell script.

The workflow ran whenever any GitHub user opened an issue on the repository. Because the issue title was interpolated directly into a `run:` block, a single quote in a crafted title was enough to break out of the shell command and execute arbitrary code on GitHub's Actions runners.

A conditional check in the workflow that appeared to be a security gate turned out to be ineffective: on issue events, the `github.event.pull_request` context is always null, so the condition evaluated to true for every user. In practice, anyone on GitHub could trigger the workflow.

Wiz says the safe pattern the AI assistant removed had been deliberately implemented to prevent exactly this class of shell injection — a historical context the automated assistant had no way of knowing.

Red Agent Found It — and Refused to Fail

What makes the case remarkable is how the flaw was discovered. Wiz's Red Agent, an autonomous offensive security agent, was scanning Snowflake's GitHub organization with a CI/CD analysis capability when it flagged the workflow as vulnerable to script injection.

When the agent attempted to exploit the flaw, its first payload — which used a comment character to truncate the shell command — failed with a bash syntax error. Rather than stopping, the researchers wrote, Red Agent autonomously analyzed the error, adjusted its payload to properly close the shell syntax, and successfully exfiltrated Jira credentials to an out-of-band callback server. The callback arrived from a GitHub Actions runner, carrying the credentials in base64-encoded form.

The exfiltrated token belonged to an account with read access across Snowflake's engineering, security compliance, and bug bounty tracking projects in Jira.

Five Days From Injection to Patch

The disclosure timeline published by Wiz moves fast:

  • June 18, 2026 — the vulnerable pattern is introduced by a commit co-authored by Copilot Autofix
  • June 23, 2026 — Wiz identifies, exploits, and reports the flaw to Snowflake via HackerOne
  • June 23, 2026 — Snowflake patches the workflow the same day, restoring the safe `env:` variable and `jq` parsing pattern
  • June 24, 2026 — the exposed Jira token is revoked and rotated
  • July 25, 2026 — coordinated public disclosure

Snowflake told Wiz that its investigation found no evidence of unauthorized access. "The disclosure was received on June 23, 2026, and it was immediately investigated and remediated, and our investigation found no evidence of unauthorized access," the company said in a statement, adding that it is working with Wiz to share the learnings with the broader industry.

The Bigger Lesson: AI Code Needs Human-Grade Scrutiny

Wiz drew three takeaways from the incident, and they extend well beyond Snowflake.

First, AI-generated pull requests must undergo the same static analysis and security review as human code. Coding assistants predict code from probabilistic patterns, which means they can silently reintroduce deprecated or insecure constructs that a repository had already eliminated.

По-друге, вікна відкриття руйнуються. Уразливість існувала лише п’ять днів, перш ніж автоматизований агент знайшов і підтвердив її — швидкість, яка припускає, що зловмисники, які сканують за допомогою подібних інструментів, можуть рухатися так само швидко. Швидкі цикли виправлення та короткострокові облікові дані стають базовими вимогами.

По-третє, організаціям потрібні огорожі, які не дозволять помічникам штучного інтелекту замінити аналізатори структурованих даних прямою інтерполяцією рядків — саме той регрес, який стався тут.

Інцидент стався в момент ширшого самоаналізу індустрії щодо коду, згенерованого ШІ. Низка нещодавніх досліджень і прикладів із реального світу показали, що інструменти кодування штучного інтелекту можуть впевнено створювати помилки, прогалини в безпеці та головні болі в обслуговуванні разом із підвищенням продуктивності. Що робить випадок Snowflake відмінним, так це замкнутий цикл: ШІ, який спричинив проблему, і ШІ, який її виявив, діяли автономно, а люди спостерігали за наслідками.

Для команд безпеки повідомлення від Wiz є відвертим. Питання більше не в тому, чи код, написаний штучним інтелектом, міститиме вразливості, а в тому, чи зможе ваш конвеєр виявлення, людський чи автоматизований, знайти їх швидше, ніж це робить чийсь агент.

Будьте попереду кривої ШІ

Інструменти кодування ШІ та автономні агенти змінюють безпеку програмного забезпечення в реальному часі. Додайте в закладки AI Buzz Wire для щоденних звітів про галузь ШІ.

Читати більше новин AI →