Bottom line: An autonomous AI security agent from Wiz found and exploited a critical command injection vulnerability in Snowflake’s GitHub Actions pipeline that had previously been missed by both GitHub Copilot and GitHub Advanced Security.
An autonomous security agent from vendor Wiz independently found and exploited a critical vulnerability in Snowflake’s GitHub Actions pipeline – even though GitHub Copilot had previously classified the underlying code change as harmless. The case shows how unreliable AI-assisted code reviews can be at detecting security vulnerabilities, and how autonomous attack tools can operationalize such gaps within minutes.
Wiz’s autonomous security tool “Red Agent” identified a vulnerability in the “jira_issue.yml” workflow of Snowflake’s “snowflake-connector-net” repository. The workflow ran on every newly created GitHub issue and processed the issue title as part of a shell command. A change introduced via PR#1218 altered the handling of this input in a way that allowed attackers to inject and execute their own commands. An existing safeguard against untrusted users failed to trigger because it was designed for pull requests, whereas the attack vector ran via issues – meaning any GitHub user could bypass the check. The vulnerability went live on June 18 when PR#1218 was merged; GitHub Advanced Security had scanned the final code but failed to detect the injection vulnerability.
GitHub Copilot was involved as a co-author on the associated pull request and had reviewed the merged code change without noticing the critical vulnerability. In a subsequent clarification, Wiz explicitly stated that it remains unclear whether Copilot itself authored the flawed code – the original wording of the disclosure had drawn criticism on this point. Wiz CTO Ami Luttwak told CSO Online that attributing responsibility between human and AI is becoming increasingly difficult when multiple agents contribute to, scan, and modify each PR – simply looking at a PR’s co-authors is no longer sufficient as an attribution criterion.
Red Agent discovered the vulnerability as part of an autonomous scan of Snowflake’s GitHub organization and independently crafted a manipulated issue title designed to break out of a shell “echo” statement and send Jira credentials to an external listener. The first exploit attempt failed due to a syntax error; the agent analyzed the error on its own, adjusted its payload, and built a working exploit on the second attempt. The GitHub Actions runner then sent base64-encoded Jira credentials via an out-of-band callback. Using these credentials, Wiz gained read access to Snowflake’s internal Atlassian environment, including engineering, security-compliance, and bug-bounty projects.
The vulnerability had already been active for five days by the time Red Agent discovered it. Wiz reported the finding on June 23 via HackerOne; Snowflake patched the workflow the same day and restored the more secure input handling, and the affected Jira credentials were rotated the following day. Snowflake’s forensic investigation found no evidence of third-party access during the exposure window; Wiz also confirmed that all data accessed as part of the proof-of-concept was securely deleted.
For CISOs, the case highlights two parallel developments that must be considered together: first, AI-assisted code review tools such as Copilot or GitHub Advanced Security alone are not sufficient to reliably detect command injection vulnerabilities in CI/CD pipelines – safeguards must be correctly configured and regularly tested for all relevant trigger types (pull requests as well as issues). Second, autonomous offensive AI agents drastically shorten the time between discovering and exploiting a vulnerability, including independent error analysis and payload adjustment after failed attempts. Organizations that use secrets such as API or Jira credentials in CI/CD workflows should shorten rotation cycles, consistently enforce least-privilege principles, and reassess the attribution of code changes between human and AI actors in their audit processes.
Source: www.csoonline.com · Published August 19, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.