Wiz AI Exploits Snowflake Bug Created by GitHub Copilot
An autonomous security agent from Wiz exploited a critical vulnerability in a Snowflake repository that was introduced by GitHub Copilot, highlighting the risks of AI-driven coding.
On June 23, 2026, Wiz Research revealed that its autonomous AI security tool, Red Agent, discovered and exploited a critical script injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository. The flaw had been introduced just five days earlier on June 18, 2026, via pull request #1218 and commit 4a1b8ce, which was co-authored by GitHub's Copilot Autofix. The AI-generated code replaced a secure input-sanitization pattern that used env variables and jq with direct string interpolation, creating an injection vector in the jira_issue.yml workflow.
Wiz's Red Agent scanned the repository and identified that any GitHub user could trigger the vulnerable workflow by opening an issue. When the agent's initial exploit payload caused a bash syntax error, the autonomous tool analyzed the error and adjusted its payload from using a comment character to a semicolon and echo command. This allowed it to successfully execute arbitrary commands and exfiltrate a Jira API token associated with qa@snowflake.net. The exfiltrated credential granted read access to Snowflake's engineering, security compliance, and bug bounty tracking projects on Jira.
Upon receiving the report via HackerOne, Snowflake patched the vulnerability on the same day through pull request #1402 and commit 1dc7766, restoring the safe env and jq parsing pattern. Snowflake also rotated the affected credential and confirmed that no unauthorized third parties accessed the systems during the five-day exposure window.
For software development and security practitioners, this incident demonstrates that AI coding assistants can inadvertently reintroduce deprecated or insecure patterns. Because automated tools lack historical context, they may strip out custom security guardrails. Security teams must treat AI-generated pull requests with the same rigorous static analysis and manual review as human code, while preparing for a landscape where automated agents can discover and exploit new vulnerabilities within hours.
This is our own summary of reporting by Hacker News
