AI agent exploits Snowflake CI bug that GitHub's scanner missed
Wiz's autonomous Red Agent self-corrected its payload to steal a Jira token in seconds — and GitHub now disputes that Copilot wrote the flaw.
Copy markdown
It cracked its own payload, then grabbed a token
Wiz's Red Agent hit a syntax error on its first injection into Snowflake's jira_issue.yml workflow, rewrote the payload on its own, and exfiltrated a base64 Jira token from the runner in seconds — reaching internal engineering, security-compliance and bug-bounty projects. The 5-day hole was patched the day Wiz reported it (June 23) and Snowflake says no outside attacker got in.
GitHub disputes that Copilot wrote the bug
Wiz first pinned it on Copilot Autofix, citing its co-author line on the merged commit. GitHub's review says a human wrote the vulnerable lines back on Aug 25, 2025 and a squash-merge just carried Copilot's name over; Wiz softened to "unclear whether the change was AI-assisted." What nobody disputes: an autonomous agent found and exploited it.
Advanced Security scanned it and shrugged
The bad commit swapped a safe env:/jq pattern for direct ${{ github.event.issue.title }} interpolation, with sed sanitization running after template expansion — so a lone single quote broke out into arbitrary Bash. GitHub Advanced Security analyzed the workflow and never flagged the injection.
What to change in your Actions this week
Never drop github.event.* straight into a run: block — pass untrusted input through env: and quote it. Give AI-written PRs the same static analysis and human review as any other code, and rotate CI tokens so a stolen one dies fast. The workflow fired on any new issue, so it was reachable by anyone, no login needed.