As part of ongoing security research conducted through Snowflake’s HackerOne vulnerability disclosure program, Wiz Research’s "Red Agent"—an autonomous, AI-powered security research tool—identified a critical GitHub Actions workflow vulnerability in one of Snowflake’s public repositories.

This incident highlights a new reality in software development: Critical vulnerabilities can still be introduced and approved within workflows involving AI coding agents, while autonomous AI security agents can rapidly discover and exploit them in the wild.

Upon responsible disclosure on June 23, 2026 by Wiz, Snowflake remediated the vulnerability on the same day, rotated the affected credential, and verified via detailed audit logs that Wiz was the sole actor during the exposure window. Wiz confirmed that all data accessed during proof-of-concept testing was securely deleted.

August 17, 2026, 1957 UTC update: This blog has been updated to clarify that Copilot was a co-author that checked the merged PR and code change, and identified it as all-clear without noticing the critical vulnerabilities. It's unclear whether the code-change was AI-assisted.

Wiz Red Agent identified a script injection vulnerability in snowflakedb/snowflake-connector-net . The issue allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner by opening a GitHub issue with a specially crafted title.

Crucially, the vulnerability became live on June 18, 2026 - just five days before its discovery -when PR #1218 was merged. The final squash commit credits “Copilot Autofix powered by AI” as a co-author. The merged PR replaced the repository’s sanitized input pattern with direct string expansion, yet GitHub’s AI-assisted security review did not flag the resulting critical vulnerability.

Discovery

Wiz Red Agent's CI/CD capability scanned Snowflake's GitHub organization and flagged the jira_issue.yml Workflow in snowflakedb/snowflake-connector-net as vulnerable to script injection via untrusted input in run: blocks.

The Code Change

- env : - ISSUE_TITLE : ${{ github.event.issue.title }} - run : jq -n --arg title "$ISSUE_TITLE" ... + run : TITLE=$(echo '${{ github.event.issue.title }}' | sed ...)

The workflow triggered on issues: opened - meaning any GitHub user could fire it by opening an issue - and interpolated the attacker-controlled issue title directly into a shell script:

run : | TITLE=$(echo '${{ github.event.issue.title }}' | sed 's/"/\\"/g' | sed "s/'/\\\'/g")

The sed escaping runs after GitHub's template expansion, a single quote in the title breaks out of echo '...' and allows arbitrary command execution.

The injectable pattern was introduced just days earlier, on June 18, 2026, commit 4a1b8ce ( PR #1218: “SNOW-2069227: Update jira workflows” ) - co-authored by Copilot Autofix powered by AI .

Main content shown as an extended quote; the full article is at the source link.

Read original ↗ Content from Hacker News Frontpage（Community）