AI-Generated Copilot Autofix Introduced Critical Vuln in Snowflake's GitHub Repo
Original: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
Why This Matters
Demonstrates that AI-assisted code review can introduce and approve critical security vulnerabilities, while autonomous AI agents can discover and exploit them faster than human teams.
Wiz Research's autonomous Red Agent discovered a GitHub Actions script injection vulnerability in Snowflake's public repository on June 23, 2026—five days after it was introduced by a GitHub Copilot Autofix co-authored commit. The flaw allowed unauthenticated access to Snowflake's internal Jira via an exfiltrated token. Snowflake remediated the issue the same day it was disclosed.
Wiz Research's autonomous AI security tool, dubbed 'Red Agent,' identified a critical script injection vulnerability in the snowflakedb/snowflake-connector-net GitHub repository as part of Snowflake's HackerOne vulnerability disclosure program. The flaw existed in a GitHub Actions workflow (jira_issue.yml) that triggered when any GitHub user opened an issue. By placing a specially crafted title in a GitHub issue, an unauthenticated attacker could execute arbitrary commands within the GitHub Actions runner and exfiltrate a token granting access to Snowflake's internal Jira portal.
The vulnerability was introduced on June 18, 2026, when PR #1218 ('SNOW-2069227: Update jira workflows') was merged. The squash commit credits 'Copilot Autofix powered by AI' as a co-author. The change replaced a safe input sanitization pattern—which used an env: variable and jq—with direct ${{ github.event.issue.title }} shell interpolation. The sed-based escaping applied after GitHub's template expansion, allowing a single quote in the issue title to break out of the shell string and enable command injection. Critically, GitHub's AI-assisted security review approved the PR without flagging the vulnerability.
Wiz responsibly disclosed the issue on June 23, 2026. Snowflake patched it the same day, rotated the affected credential, and confirmed via audit logs that Wiz was the only actor during the exposure window. All data accessed during proof-of-concept testing was securely deleted.