Copilot Autofix wrote a shell-injection bug into Snowflake's CI
An autonomous AI agent found and exploited the flaw in five days, exfiltrating a Jira token — a live case for auditing every AI-generated GitHub Actions file.
Copy markdown
The bug it wrote: a one-quote shell break
On June 18, Copilot Autofix “fixed” Snowflake's jira_issue.yml by swapping a safe env: variable for ${{ github.event.issue.title }} piped straight into a shell run: step. A single quote in an issue title breaks out and runs arbitrary commands — no auth needed.
AI vs. AI: exploited in five days
Wiz's autonomous Red Agent found the flaw and crafted a malicious issue title that curl'd a Jira API token (authenticated as qa@snowflake.net) to an out-of-band server. That token had read access across Snowflake's engineering, security-compliance, and bug-bounty projects.
Audit your AI-written workflows this weekend
Snowflake patched same-day and rotated the token; the exposure window was five days. Grep your .github/workflows for ${{ github.event.* }} interpolated into run: shell and move it back to env: vars — and put AI-generated code through the same static analysis as human PRs.
Elsewhere: Claude Code 2.1.233 adds per-user spend
The new build wires GitLab merge-request URLs into --worktree, adds an opt-in forward_user_identity gateway header so a proxy can attribute spend per user, and drops the Todo/Task tools by default on Opus 4.8, Sonnet 5 and newer (restore with CLAUDE_CODE_ENABLE_TODO_TOOLS=1).