As portion of ongoing information investigation conducted done Snowflake’s HackerOne vulnerability disclosure program, Wiz Research’s "Red Agent"—an autonomous, AI-powered information investigation tool—identified a captious GitHub Actions workflow vulnerability successful 1 of Snowflake’s nationalist repositories.
This incident highlights a quickly emerging reality successful package development: how AI coding assistants tin inadvertently present workflow injection vulnerabilities, and really automated AI agents tin quickly aboveground them successful the wild.
Upon responsible disclosure connected June 23, 2026 by Wiz, Snowflake remediated the vulnerability connected the aforesaid day, rotated the affected credential, and verified via elaborate audit logs that Wiz was the sole character during the vulnerability window. Wiz confirmed that each information accessed during proof-of-concept testing was securely deleted.
Wiz Red Agent identified a book injection vulnerability successful snowflakedb/snowflake-connector-net. The rumor allowed an unauthenticated personification to execute arbitrary commands wrong a GitHub Actions runner by opening a GitHub rumor pinch a specially crafted title.
Crucially, the vulnerability was introduced connected June 18, 2026—just 5 days anterior to discovery—via a perpetrate co-authored by Copilot Autofix powered by AI (PR #1218). The AI adjunct removed the repository's existing sanitized input shape and replaced it pinch nonstop drawstring description successful a ammunition script.
Discovery
Wiz Red Agent's CI/CD capacity scanned Snowflake's GitHub statement and flagged the jira_issue.yml Workflow successful snowflakedb/snowflake-connector-net arsenic susceptible to book injection via untrusted input successful run: blocks.
AI Assistant (Github Copilot) Change
The workflow triggered connected issues: opened - meaning immoderate GitHub personification could occurrence it by opening an rumor - and interpolated the attacker-controlled rumor title straight into a ammunition script:
The sed escaping runs aft GitHub's template description , a azygous quote successful the title breaks retired of echo '...' and allows arbitrary bid execution.
The injectable shape was introduced conscionable days earlier, connected June 18, 2026, commit 4a1b8ce (PR #1218: “SNOW-2069227: Update jira workflows”) - co-authored by Copilot Autofix powered by AI.
It removed the repository’s existing safe pattern, which passed the rumor title done an env: adaptable and built the JSON payload pinch jq. Instead it utilized the nonstop ${{ github.event.issue.title }} interpolation shown above. In different words, an AI “autofix” perpetrate created the very injection vector.
The Open “Security Gate”
The workflow had an if: information that appeared protective:
However, connected issues events, github.event.pull_request is ever null.
So the information reduces to (null != 'whitesource-for-github-com[bot]'). This is ever true, and each GitHub personification passes the gate.
We crafted an rumor title that, aft template description , breaks retired of the echo drawstring and exfiltrates the Jira credentials via an out-of-band callback:
Crucially, erstwhile Red Agent’s cicd capacity initially attempted exfiltration utilizing a modular remark characteristic (#), the runner returned a bash syntax correction because the remark consumed the closing parenthetical of TITLE=$(...). Rather than stopping aliases failing, Red Agent:
autonomously analyzed the syntax execution error
adjusted its payload to usage ; echo ' to decently adjacent the ammunition block, and
successfully received the out-of-band callback
Within seconds, our listener received the callback from a GitHub Actions runner (Azure IP 20.106.182.197) containing base64-encoded credentials.
Note: Our first effort utilized # to remark retired the remainder of the line, which caused an unexpected EOF bash correction because it besides ate the closing ) of TITLE=$(...). The hole was utilizing ; echo ' to decently adjacent the ammunition syntax.
The exfiltrated token authenticated arsenic [email protected] to snowflakecomputing.atlassian.net, granting publication entree crossed Snowflake's engineering, information compliance, and bug bounty search projects.
Same-Day Patching: Snowflake patched the workflow connected June 23, 2026 (1dc7766, PR #1402), afloat restoring the safe env: adaptable and jq --arg parsing pattern.
Credential Revocation: The JIRA token successful mobility was revoked and rotated.
Forensic Verification: Comprehensive audit log study confirmed that nary outer 3rd parties accessed the endpoint during the 5-day vulnerability window. All anomalous queries were strictly matched to Wiz's testing IPs.
AI Code Generation Demands Rigorous Oversight: AI coding devices foretell codification based connected probabilistic patterns, which tin inadvertently reintroduce deprecated aliases insecure ammunition patterns. AI-generated PRs must acquisition the aforesaid fixed study and information scrutiny arsenic quality code.
Collapsing Discovery Windows: The vulnerability was unrecorded for only 5 days earlier an automated supplier discovered and validated it. Security operations must accommodate to a scenery wherever automated find occurs successful hours, requiring accelerated spot cycles and short-lived credentials.
Preventing AI Security Regressions: Automated AI assistants often deficiency humanities discourse regarding why circumstantial codification patterns were chosen. In this incident, an automated PR removed a safe env: + jq parsing shape that had been explicitly implemented to forestall ammunition injection. Security teams must instrumentality Guardrails that artifact AI agents from replacing system information parsers pinch nonstop drawstring interpolation.
Disclosure Timeline
June 18, 2026 - Script-injection shape introduced successful jira_issue.yml by perpetrate 4a1b8ce (PR #1218), co-authored by Copilot Autofix powered by AI
June 23, 2026 - Wiz identified, exploited, and reported vulnerability to Snowflake via HackerOne (report #3819931)
June 23, 2026 - Slack notification sent to Snowflake information team
June 23, 2026 (same day) - Snowflake patches the susceptible script-injection workflow (commit 1dc7766, PR #1402), restoring the safe env: + jq --arg pattern.
June 24, 2026 - Jira token rotated
July 25, 2026 - Public disclosure deadline (30 days aft the June 25 resolution, per Snowflake’s disclosure policy)
Snowflake appreciates Wiz's responsible reporting of and collaboration astir these findings done our vulnerability disclosure and bug bounty program, HackerOne. Wiz Research reported a information vulnerability successful 1 of Snowflake's nationalist GitHub repositories. The disclosure was received connected June 23, 2026, and it was instantly investigated and remediated, and our investigation recovered nary grounds of unauthorized access. Protecting our systems remains a apical priority, and we stay committed to continually strengthening our package improvement and information practices. We are moving together pinch Wiz to stock these learnings pinch the broader manufacture to promote wide take of these information champion practices.
English (US) · 
Indonesian (ID) · 
