AI security agent exploited a Snowflake GitHub Actions flaw that Copilot Autofix missed

Wiz Research says its autonomous security research tool, Red Agent, found and exploited a critical GitHub Actions vulnerability in a public Snowflake repository. The issue was reported through Snowflake's HackerOne disclosure program, and the findings were published on August 17, 2026.

The vulnerable workflow

The flaw sat in jira_issue.yml in the snowflakedb/snowflake-connector-net repository. The workflow fired on any newly opened GitHub issue and interpolated the attacker-controlled issue title directly into a shell script. Because GitHub's template expansion happens before the sed escaping runs, a single quote in the title breaks out of the echo string and allows arbitrary command execution. The bug went live on June 18, 2026, when PR #1218 was merged — five days before it was discovered.

How the agent exploited it

Red Agent opened an issue whose title exfiltrated Jira credentials through an out-of-band callback. Its first attempt failed: a # comment consumed the closing parenthesis of TITLE=$(...), producing a bash syntax error. The agent analysed that error on its own, switched its payload to "; echo '", and within seconds received a callback from a GitHub Actions runner on Azure IP 20.106.182.197 carrying base64-encoded credentials.

Why automated checks stayed quiet

The stolen token authenticated as [email protected] against snowflakecomputing.atlassian.net, granting read access across Snowflake's engineering, security compliance and bug bounty projects. The workflow carried a gate that checked the opener's login against github.event.pull_request.user.login — but on issues events that field is always null, so the condition was always true. GitHub Advanced Security scanned the final revision without flagging the injection, and the merged pull request had replaced a safe env: plus jq pattern with direct interpolation.

Response and takeaways

Snowflake patched the workflow the same day it was reported (commit 1dc7766, PR #1402) and revoked and rotated the Jira token on June 24; audit logs showed no third-party access during the five-day exposure window. Wiz notes that Copilot was a co-author that reviewed the merged change and called it all-clear, adding that it is unclear whether the code change itself was AI-assisted. Its conclusion: AI-generated pull requests need the same static analysis as human code, and shrinking discovery windows demand fast patch cycles and short-lived credentials.