An AI broke Snowflake's code. Then another AI agent exploited it
- ID
- 14881
- Status
- summarized
- Published
- 18 Aug 2026, 12:36 AM
- Fetched
- 18 Aug 2026, 1:02 AM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/17/an-ai-broke-snowflakes-code-then-another-ai-agent-exploited-it/5288666
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 8.5
- Created
- 18 Aug 2026, 1:04 AM
- Tags
- Audience
- developersvibe_codersai_agent_usersai_ml_learners
What happened
GitHub Copilot Autofix introduced a script injection vulnerability into Snowflake's snowflake-connector-net GitHub Actions workflow on June 18 by removing an existing sanitized input pattern and replacing it with direct string expansion in a shell script. Five days later, Wiz's autonomous AI red agent found the bug during a routine public repo scan, exploited it by crafting a GitHub issue title that exfiltrated Jira credentials via an out-of-band callback, and gained read access to Snowflake's engineering, security compliance, and bug bounty projects. Snowflake patched the same day Wiz reported it and rotated credentials the next day, confirming a five-day exposure window with no unauthorized access beyond Wiz.
Why it matters
If you use AI coding assistants that auto-fix or auto-generate commits, you need to treat their output as untrusted code that can remove existing security sanitization patterns — not just as suggestions to eyeball. This incident shows an AI removing a working input sanitization pattern and replacing it with a vulnerable one, which then sat in a public repo for five days undetected by human review. Audit AI-generated diffs for security regressions in CI/CD workflows, especially in GitHub Actions run: blocks where shell injection is possible, and consider running automated security scanning on every commit rather than relying on human review.
Discussion angle
The symmetry here is the real story: an AI introduced the bug by removing sanitization, and an AI found and exploited it autonomously — human review caught neither side. Discuss whether your team's CI pipeline would have caught Copilot Autofix removing a security pattern, and what automated guardrails (diff-based security checks, secret scanning on every commit, blocking unsanitized shell expansion in Actions workflows) you'd need to make AI-assisted commits safe to merge.