GitHub Copilot Autofix PR opens flaw, Wiz's AI agent breaches Snowflake's Jira
Wiz Research says its autonomous "Red Agent" tool independently discovered, exploited and assessed the impact of a critical GitHub Actions vulnerability in Snowflake's public repository snowflakedb/snowflake-connector-net, with no human intervention, as part of ongoing research under Snowflake's HackerOne bug bounty program.
The flaw traces to pull request #1218, merged on June 18, 2026. Its final squash commit credits "Copilot Autofix powered by AI" as a co-author. The PR replaced the workflow's existing safe pattern, which passed the GitHub issue title through an env: variable and built a JSON payload with jq, with direct string interpolation of the issue title into a shell command inside the jira_issue.yml workflow. That workflow triggered on any GitHub issue being opened, so any user could fire it. A guard condition that looked protective, checking github.event.pull_request against a bot account name, was always true on issue events because that field is always null there, so it blocked no one. GitHub's AI-assisted security review did not flag the resulting critical vulnerability. Wiz's blog was updated on August 17, 2026 to clarify that Copilot Autofix's confirmed role was co-authoring and reviewing the merged PR and code change, marking it "all-clear" without catching the flaw; whether the vulnerable line of code was itself AI-generated is stated as unclear.
Wiz Red Agent's CI/CD scanning capability flagged the workflow as vulnerable to script injection via untrusted input in a run: block. The team crafted a GitHub issue title that, after GitHub's template expansion, would break out of the shell string and exfiltrate credentials via an out-of-band callback. The agent's first attempt used a # character to comment out the rest of the line, which produced a bash syntax error because the comment also consumed the closing parenthesis of the command. Rather than stopping, Red Agent analyzed the error itself and adjusted the payload to use "; echo '" to properly close the shell block. Within seconds the exploit succeeded: a listener received a callback from a GitHub Actions runner on Azure IP 20.106.182.197 carrying base64-encoded credentials.
The stolen token authenticated as qa@snowflake.net to snowflakecomputing.atlassian.net, granting read access across Snowflake's engineering, security compliance, and bug bounty tracking Jira projects, all five days after the vulnerable PR had gone live.
Snowflake patched the workflow the same day Wiz reported it, June 23, 2026, restoring the safe env: plus jq --arg pattern in commit 1dc7766 (PR #1402). The Jira token was rotated the next day, June 24. Snowflake's audit log review found that no external party besides Wiz's own testing infrastructure accessed the endpoint during the five-day exposure window, and Wiz says all data it accessed during proof-of-concept testing was securely deleted. The source lists a public disclosure deadline of July 25, 2026, thirty days after what it calls "the June 25 resolution" per Snowflake's disclosure policy, a date that does not match the June 23 patch date stated elsewhere in the same post; the source does not explain the discrepancy.
Key facts
- PR #1218, merged June 18, 2026 and credited to "Copilot Autofix powered by AI" as co-author, replaced a safe env:+jq input-sanitization pattern with direct string interpolation of a GitHub issue title into a shell command, opening a script-injection hole in snowflakedb/snowflake-connector-net's jira_issue.yml workflow.
- Wiz Research's autonomous "Red Agent" found and exploited the flaw five days after it went live, entirely without human intervention; when its first exploit attempt hit a bash syntax error, it autonomously diagnosed the error and rewrote the payload to close the shell block correctly.
- The exploit exfiltrated a credential, via a callback from Azure IP 20.106.182.197, that authenticated as qa@snowflake.net to snowflakecomputing.atlassian.net and granted read access to Snowflake's engineering, security compliance, and bug bounty tracking Jira projects.
- Snowflake patched the workflow the same day it was reported, June 23, 2026 (commit 1dc7766, PR #1402), rotated the Jira token the next day, and its audit logs found no access to the endpoint beyond Wiz's own testing IPs during the five-day exposure window.
- An August 17, 2026 update to the blog clarified that Copilot Autofix's confirmed role was co-authoring and reviewing the merged PR, marking it all-clear without catching the bug; it remains unclear whether the vulnerable code itself was AI-generated.
Why it matters
This is a documented case of an AI coding assistant's own output creating a critical security hole that the same class of AI review then failed to catch, followed within days by an autonomous AI agent finding and exploiting that hole on its own, end to end, without a human in the loop. It puts a concrete incident behind two claims that are usually made separately: that AI-generated code needs the same scrutiny as human code, and that autonomous AI offensive tooling can now compress vulnerability discovery from a matter of routine audits down to days.
Who it affects
Teams that let Copilot Autofix or similar AI review tools approve changes to CI/CD workflows, and open source maintainers running GitHub Actions on public repositories that accept untrusted triggers like opened issues. Security teams that treat AI code review as a sufficient gate rather than one layer among several. Snowflake itself, and by extension any organization relying on GitHub Actions workflows with similar issue-triggered automation.
How to use it
There is no product or price here; the piece functions as a case study with two concrete defensive takeaways stated by Wiz. AI-generated pull requests should go through the same static analysis and security review as human-written code, not less. Teams should put guardrails in place that specifically block AI agents from replacing structured, sanitized data handling, such as an env: variable parsed with jq, with direct string interpolation into a shell command.
How solid is it
The account comes from Wiz Research's own blog, describing a vulnerability its own "Red Agent" tool found and exploited under Snowflake's official HackerOne disclosure program, so Wiz has a direct interest in showcasing the tool's capability. That said, the post carries specific, checkable technical detail: PR and commit identifiers, exact dates, the vulnerable and patched code patterns, a HackerOne report number, and the exfiltrating IP address. Snowflake's own statement, quoted in the piece, confirms the report was received, investigated and remediated with no evidence of unauthorized access. The post was also revised on August 17, 2026 to narrow an earlier claim about Copilot's exact role, which reads as a self-correction rather than a retraction.
Risks and caveats
The source is the vendor whose tool performed the exploit, publishing what also serves as a capability demonstration for its own product, so some framing toward the dramatic is plausible. The post itself flags that it is unclear whether the vulnerable line of code was AI-generated; only Copilot Autofix's role as a co-author that reviewed the merged PR and marked it clear is confirmed. The post also contains an internal date inconsistency it does not resolve: it states the workflow was patched on June 23, 2026, but computes its public disclosure deadline as thirty days after what it calls the June 25 resolution.
“AI-generated PRs must undergo the same static analysis and security scrutiny as human code.”
— Wiz Research, "Key Takeaways"