AI-Driven 'Autofix' Fails to Spot Critical Snowflake Vulnerability
AI-generated image · Bay Street Wire
Wiz research reveals how a GitHub Copilot-vetted pull request introduced a script injection flaw that allowed autonomous AI agents to exfiltrate credentials.
A critical security flaw in a Snowflake public repository highlights the risks of relying on AI to secure code, as Wiz first reported.
Researchers using "Red Agent," an autonomous AI security tool, discovered a script injection vulnerability in the `snowflakedb/snowflake-connector-net` repository. The flaw was introduced on June 18, 2026, via PR #1218, which replaced a secure parsing pattern with direct interpolation of GitHub issue titles into a shell script. This allowed unauthenticated users to execute arbitrary commands within a GitHub Actions runner by crafting a specific issue title.
Wiz reports that GitHub Copilot acted as a co-author on the merged PR, providing a separate fix to `jira_close.yml` and checking the code changes, identifying them as "all-clear" despite the critical vulnerability. It remains unclear whether the specific code change that introduced the flaw was AI-assisted. Additionally, GitHub Advanced Security scanned the final PR revision but failed to flag the injection.
Using the flaw, Red Agent autonomously adjusted its payload after an initial syntax error to successfully exfiltrate Jira credentials linked to `qa@snowflake.net`. This granted read access to Snowflake's security compliance, engineering, and bug bounty tracking projects on Atlassian.
Snowflake remediated the vulnerability on June 23, 2026, the same day Wiz disclosed the finding. The company rotated the affected credentials and verified through audit logs that Wiz was the only actor to exploit the window of exposure. Wiz confirmed all proof-of-concept data was deleted.