AI Copilot Introduced GitHub Actions Flaw in Snowflake Repo

AI assistant creates vulnerability, AI agent finds it

An autonomous AI security research tool discovered a critical GitHub Actions vulnerability in a Snowflake public repository—a flaw that was itself introduced by an AI coding assistant just five days earlier.

Wiz Research's "Red Agent" identified the script injection vulnerability in Snowflake's snowflakedb/snowflake-connector-net repository on June 23, 2026. The vulnerability allowed any GitHub user to execute arbitrary commands on GitHub Actions runners simply by opening an issue with a malicious title. Snowflake patched the flaw the same day and confirmed through audit logs that Wiz was the only party to access the exposed credentials during the brief window.

How the vulnerability was introduced

The security flaw originated in a pull request merged on June 18, 2026, that was co-authored by GitHub Copilot Autofix. The AI assistant modified a workflow file that creates Jira tickets from GitHub issues.

The original code safely handled user input by passing the issue title through an environment variable and processing it with jq, a JSON parser. Copilot's changes removed this protection and instead directly interpolated the untrusted issue title into a shell command using GitHub's template expansion syntax.

The new code attempted to sanitize the input with sed commands, but these ran after GitHub expanded the template—meaning an attacker could inject shell commands before any escaping occurred. A single quote in an issue title was enough to break out of the echo statement and execute arbitrary code.

Autonomous exploitation in real time

When Red Agent initially attempted to exploit the vulnerability using a standard comment character to terminate the command, it received a bash syntax error. Rather than failing, the AI agent analyzed the error, recognized that the comment was consuming necessary shell syntax, and autonomously adjusted its payload to properly close the shell block.

The successful exploit exfiltrated Jira API credentials that provided read access to Snowflake's engineering, security compliance, and bug bounty tracking projects. The entire discovery-to-exploitation process occurred within the tool's automated workflow.

Why it matters

This incident reveals a troubling dynamic in modern software development: AI coding assistants can introduce security vulnerabilities by lacking historical context about why specific patterns were chosen, while AI security agents can discover and exploit those flaws within days or hours. The five-day window between introduction and discovery represents a dramatic compression of the traditional vulnerability lifecycle.

For security teams, this means static analysis gates must apply equally to AI-generated code, and credential rotation cycles may need to accelerate to match the speed of automated discovery. Organizations using AI coding assistants should implement guardrails that prevent automated tools from replacing structured data parsers with direct string interpolation in security-sensitive contexts like CI/CD workflows.

Snowflake's response

Snowflake restored the original safe pattern using environment variables and jq parsing, rotated the exposed Jira token, and conducted forensic analysis confirming no unauthorized access occurred. The company publicly acknowledged the findings and emphasized its commitment to strengthening development security practices.

The details were first reported by Wiz Research through Snowflake's HackerOne vulnerability disclosure program.