AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
- ID
- 14996
- Status
- summarized
- Published
- 17 Aug 2026, 10:18 PM
- Fetched
- 19 Aug 2026, 4:28 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug
- Source URL
- https://hnrss.org/best
Summary
- Score
- 9.0
- Created
- 19 Aug 2026, 4:28 PM
- Tags
- Audience
- developersvibe_codersai_agent_usersai_ml_learnerssaas_startups
What happened
Wiz's autonomous AI security agent 'Red Agent' discovered and exploited a GitHub Actions script injection vulnerability in Snowflake's public repo (snowflakedb/snowflake-connector-net) five days after it went live. The vulnerability was introduced by PR #1218, co-authored by 'Copilot Autofix powered by AI,' which replaced a sanitized input pattern with direct string expansion of GitHub issue titles into a run: block—yet GitHub's AI-assisted security review flagged nothing. The exploit let an unauthenticated attacker execute arbitrary commands on a GitHub Actions runner and exfiltrate a token to access Snowflake's internal Jira.
Why it matters
If you use Copilot Autofix or similar AI-assisted code review in your CI/CD pipelines, this is concrete evidence that AI can introduce critical vulnerabilities and AI security review can miss them. Audit any AI-generated PRs that touch GitHub Actions workflows, especially changes involving ${{ github.event.* }} expressions in run: blocks—replace direct string interpolation with environment variable passing. Do not assume AI-assisted review catches injection flaws in YAML workflows.
Discussion angle
Both the bug and the discovery were AI-driven—Copilot introduced the flaw, Copilot's security review missed it, and Wiz's autonomous Red Agent found and exploited it without human intervention. What does this mean for the trust boundary between AI coding assistants and AI security tooling, and should teams treat AI-generated PRs as untrusted input requiring mandatory human security review?