An AI coding assistant silently introduced a script injection flaw into Snowflake’s GitHub Actions workflow, which was then autonomously discovered and exploited by an AI attack agent that exfiltrated internal Jira credentials before the cloud data giant pushed an emergency fix.[1][2][3]
According to technical details published by Wiz, the vulnerability resided in jira_issue.yml, a GitHub Actions workflow in the public snowflakedb/snowflake-connector-net repository used for Snowflake’s .NET data connector.[1][2] The workflow fired whenever a GitHub issue was opened and interpolated the issue title directly into a shell command, allowing an attacker to break out of an echo string and inject arbitrary commands on the Actions runner.[1][2] Because the trigger was issues: opened, any GitHub user on the internet could submit a crafted issue title and reach the vulnerable workflow without authentication.[1][2]
Wiz’s “Red Agent,” an autonomous offensive security system, identified the bug on June 23 while scanning public repositories and iterated through exploit attempts until it successfully weaponized the issue title to execute shell commands in the CI pipeline.[1][3][5] The flaw had been introduced just five days earlier, on June 18, in a commit co-authored by GitHub’s Copilot Autofix bot, which removed a previously safe pattern that sanitized input via environment variables and jq --arg parsing and replaced it with direct string expansion in a shell script.[1][2] Using a specially crafted issue title, the agent ultimately broke out of the echo statement and exfiltrated Snowflake’s Jira credentials via an out-of-band callback, all without human intervention.[1][3]
The stolen Jira token provided read-only access to multiple internal Snowflake projects, including engineering, security compliance, and bug bounty tracking, giving Wiz’s agent visibility into sensitive workflows and tickets.[1][2][3] Wiz reported the workflow vulnerability to Snowflake on June 23, and the company restored the sanitized input pattern and patched the workflow the same day, then revoked and rotated the Jira token the following day.[1][2][3] Snowflake’s review of audit logs indicated that Wiz’s testing was the only third-party activity using the exposed credentials during the five-day window, and the company said its investigation found no evidence of unauthorized access while pledging to share best practices with the wider industry.[1][3]
Wiz says it deleted all data accessed during research and proof-of-concept exploitation, but argues the episode shows how quickly AI-generated vulnerabilities in CI/CD pipelines can be surfaced by automated attackers compared with traditional human code review.[1][5] The incident also lands amid a broader pattern of CI/CD and GitHub Actions issues, including shell injection in Langflow workflows tracked as CVE-2026-33475 and a supply chain compromise of the popular tj-actions/changed-files GitHub Action under CVE-2025-30066 that enabled secrets exposure and was added to CISA’s Known Exploited Vulnerabilities catalog.[6][11][12] GitHub’s own ecosystem has likewise seen command-injection flaws in developer tools such as GitHub Copilot and Visual Studio, cataloged under CVE-2025-53773.[13]
While the Snowflake workflow bug has not been assigned a CVE, the AI-on-AI chain of events underscores that organizations should treat AI-generated code and automated fixes as untrusted until they have passed rigorous security review, particularly in pipelines that handle secrets.[1][2][5] Security teams are already urging developers to avoid directly interpolating user-controlled data such as issue titles, branch names, or pull request metadata into run: steps in CI workflows, instead relying on strict sanitization patterns and templating logic, and to limit which secrets are accessible to workflows triggered by public events.[6][11][12] Snowflake and Wiz say they are collaborating to turn the lessons from this incident into practical guidance for hardening GitHub Actions and other CI/CD systems against both human and machine-driven attackers.[1][3][5]
References
- How Copilot Created & Red Agent Found a CI/CD Bug | Wiz Blog
- Copilot Autofix Opende een Shell‑injectie in de CI/CD‑pipeline van Snowflake
- Wiz’s Post – LinkedIn
- Posts tagged #Research | Wiz Blog
- CVE-2026-33475 Detail – NVD
- CVE-2025-30066 Details – NVD
- Supply Chain Compromise of Third-Party tj-actions/changed-files …
- CVE-2025-53773 – GitHub Advisory Database
