Automated fix from Copilot plants a vulnerability in a Snowflake repository and an intelligent agent uncovers it within days
Listen to this article
Read by Anchor
Security research conducted by the Wiz Research team through Snowflake's bug bounty program has revealed a technical incident highlighting the emerging risks of AI-assisted coding tools, where an automated modification involving Copilot Autofix introduced a command injection vulnerability into one of the company's public GitHub repositories.
The vulnerability identified in the open-source connector library repository resulted from a change made on June 18, 2026, in pull request #1218 to update a Jira workflow. During this change, the automated remediation tool removed the secure pattern previously used in the repository, which relied on passing the issue title through an environment variable and using a structured data processing tool, replacing it with direct string interpolation inside a shell script.
This change enabled arbitrary code execution inside the GitHub Actions runner environment whenever a new issue with a specially crafted title was opened. Because character sanitization occurred after template expression expansion had completed, single quotes could break out of the command context and execute external instructions without prior authentication.
The issue was not limited to the direct injection flaw, but extended to a verification gate intended to protect the workflow from untrusted inputs.The configuration file included a condition to verify the pull request author's identity in order to exclude specific accounts, but triggering the workflow on issue events left the pull request field permanently empty, automatically bypassing this check and accepting all inputs from any external user.
Meanwhile, Wiz's autonomous security research tool, Red Agent, scanned the organization, discovered the flaw, and validated it autonomously. When the tool encountered a syntax error during its initial exfiltration attempt due to a comment character, it automatically analyzed the execution error and adjusted its payload to properly close the text block, successfully receiving an outbound callback containing the encrypted credentials.
The extracted data included a Jira access token belonging to a dedicated quality assurance account, which granted read permissions across engineering, security compliance, and vulnerability tracking projects within the company's enterprise workspace.
This sequence demonstrates the risk posed by automated coding assistants lacking historical context, which may revive insecure patterns that had been deliberately eliminated in earlier stages.
Following the report on June 23, Snowflake moved quickly to patch the workflow that same day in pull request #1402 and reinstated the secure input handling pattern, while also rotating the affected authentication token and reviewing comprehensive audit logs to confirm the vulnerability had not been exploited by any other parties during its five-day exposure window.