A GitHub Actions injection leaked Snowflake's Jira token
An unsanitized issue title in a run: block was all it took — and an AI agent found and weaponized it in seconds. Check your own workflows tonight.
Copy markdown
One issue title, one leaked Jira token
A crafted GitHub issue title broke out of an echo statement in Snowflake's jira_issue.yml workflow and injected shell commands, exfiltrating a Jira API token with read access to engineering, security-compliance, and bug-bounty projects. The workflow fired on every new issue, so any anonymous user could pull the trigger; the secret sat exposed for five days.
Grep your own workflows before bed
The root cause is a footgun that's everywhere: interpolating ${{ github.event.* }} values straight into a run: block. Snowflake's fix is the standard one — pass untrusted values through env: and reference them as shell variables, never inline. Search your repos tonight for github.event.issue.title, .pull_request.title, and .comment.body sitting inside run steps.
The exploit debugged itself
This wasn't a human pentester. Wiz's autonomous Red Agent found the bug five days after it merged, hit a bash syntax error on its first payload, then rewrote it on its own to close the shell block and beacon the base64-encoded token to an out-of-band callback within seconds. Autonomous offensive agents against public CI are now a live threat model, not a demo.
GitHub disputes the Copilot angle
Wiz's original writeup credited GitHub Copilot Autofix as a co-author that waved the vulnerable PR through. GitHub's internal review says a human wrote the code and Autofix never reviewed it; Wiz softened its claim at 19:57 UTC on Aug 18 to "unclear whether the change was AI-assisted." Only one side holds the logs that would settle it.