AI Agent Finds GitHub Actions Bug, Reaches Snowflake’s Internal Jira
An AI agent designed to hunt for vulnerabilities independently discovered a flaw within a public Snowflake repository and used it to gain access to the company’s internal Jira system. The vulnerability had existed for just five days when discovered, and notably, GitHub Copilot had reviewed the code during that window without flagging the dangerous section.
Wiz’s Red Agent Uncovers the Flaw
Researchers at Wiz identified the issue using their autonomous scanning tool, Red Agent, which was reviewing Snowflake’s public GitHub repositories. The flaw resided in a GitHub Actions workflow script within the snowflakedb/snowflake-connector-net project. Any GitHub user could trigger the vulnerable process simply by opening a new issue with a specially crafted title.
How a Single Pull Request Introduced Shell Injection
The vulnerable code was introduced on June 18, 2026, following the merge of pull request #1218. Previously, an issue title was first stored in an environment variable and then safely passed to the jq utility to construct data. The new version instead inserted the issue title’s contents directly into a shell command. A single unescaped quotation mark was all it took to break out of the expected string and force the server to execute an arbitrary, attacker-supplied command.
GitHub Copilot Reviewed the Change and Missed It
Wiz paid particular attention to GitHub Copilot’s role in the incident. The corresponding commit record lists “Copilot Autofix powered by AI” as a co-author, and when Copilot reviewed the change, it assessed it as safe and failed to detect the critical flaw. Wiz was careful to clarify, however, that it cannot conclusively determine whether the vulnerable code fragment itself was originally written by the AI.
An additional safeguard, intended to prevent the workflow from running without restriction, also failed to function as designed. When an ordinary user created a standard issue, one of the fields being validated was always left empty, causing the guard condition to evaluate as true for any GitHub user without exception. As a result, the protective barrier effectively stopped no one.
Red Agent Escalated the Finding Into Credential Theft
Red Agent did not stop at identifying the flaw. The agent autonomously crafted a verification request and attempted to extract Jira credentials from the GitHub Actions execution environment. Its first attempt returned a syntax error. The system analyzed the response, adjusted its command, and tried again. Within seconds, Wiz obtained credentials granting access to Snowflake’s internal Jira instance under the account qa@snowflake.net.
The Exposed Key Granted Access to Sensitive Internal Projects
The compromised key provided read access to Snowflake projects related to internal product development practices, security compliance procedures, and the company’s vulnerability reward program. In effect, a single flaw in a public repository opened a direct pathway into the company’s internal information.
Snowflake’s Response and Remediation
Wiz reported the issue to Snowflake on June 23. The company fixed the vulnerable script that same day, restoring the original safe method of handling input data, and rotated the exposed Jira key on June 24. When investigators reviewed the access logs, they found no evidence that any unauthorized party had exploited the flaw during the five days it remained active. Snowflake stated that no signs of unauthorized access were found.
Wiz recommends that changes generated or approved by AI systems be reviewed with the same rigor and scrutiny applied to code written by humans.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
