An autonomous AI security agent built by Wiz discovered, exploited, and extracted credentials from a vulnerability in a Snowflake public GitHub repository — a flaw that had been introduced five days earlier by another AI system, GitHub Copilot Autofix1,2,5.
The incident, disclosed publicly on August 17, occurred during authorized security research conducted through Snowflake's HackerOne vulnerability disclosure program7. It provides a concrete case study of AI systems operating on both sides of the vulnerability lifecycle: one generating a security weakness, another finding and exploiting it at machine speed.
How the flaw was introduced
On June 18, 2026, a commit co-authored by "Copilot Autofix powered by AI" in pull request #1218 modified a GitHub Actions workflow called jira_issue.yml in the snowflakedb/snowflake-connector-net repository. The change removed an existing safe pattern that stored GitHub issue titles as an environment variable before building a JSON payload with jq, replacing it with direct string expansion inside a shell script. The autofix feature interfaces with OpenAI's GPT-5.3-Codex to generate suggested fixes and explanations, according to GitHub.
The result was a script injection vulnerability: because the repository was public, any external user could trigger the workflow by opening an issue with a maliciously crafted title, executing arbitrary commands within a GitHub Actions runner.
How the exploit unfolded
Wiz's Red Agent, an AI-powered autonomous offensive security tool, discovered the flaw on June 23 during a routine scan of Snowflake's public GitHub organization. The agent developed an issue title designed to break out of the shell command and transmit credentials from the Actions runner to an external listener. Its first exploit attempt failed because the payload used a shell comment character that consumed the closing parenthetical of the command. The agent analyzed the error, modified the payload to restore valid shell syntax, and tried again. The revised exploit successfully produced an outbound callback containing Base64-encoded values for a Jira API token, Jira user email address, and Jira base URL.
The extracted token was linked to the Snowflake account qa@snowflake.net and provided read access to internal engineering, security-compliance, and vulnerability-management projects, including material associated with Snowflake's bug-bounty program.
Remediation
Wiz reported the vulnerability through Snowflake's HackerOne program on June 23 under report number 3819931. Snowflake patched the workflow the same day in commit 1dc7766 and pull request #1402, restoring the safer design by moving the untrusted issue title back into an environment variable and using jq --arg to construct structured data. The Jira token was revoked and rotated on June 24. Snowflake's audit log review found no evidence that anyone other than Wiz accessed the affected endpoint during the five-day exposure window. No CVE has been assigned.
Wiz Red Agent became generally available in July and now supports 40% of Wiz's customers, scanning millions of assets monthly6. Wiz is now part of Google Cloud following Google's completion of its acquisition in March 2026.
Wiz concluded that AI-generated code, including pull requests from tools such as Copilot Autofix, requires the same static analysis and security scrutiny as human-written code. The company said guardrails should be implemented to prevent AI coding agents from replacing safe code patterns with risky ones such as direct string interpolation. GitGuardian reported earlier this year that commits co-authored by Claude Code leaked secrets at approximately twice the baseline rate.
ANALYSIS The five-day window between the introduction of the flaw and its autonomous exploitation underscores the speed mismatch between AI-assisted code generation and traditional security review cycles — a gap that favors automated attackers when credentials are long-lived and workflow configurations go unaudited.