An autonomous AI security agent built by cloud security firm Wiz discovered and exploited a critical vulnerability in Snowflake's GitHub Actions pipeline, successfully extracting internal Jira credentials after GitHub Copilot had previously reviewed the vulnerable code without detecting the security flaw. The incident highlights growing challenges in code security as AI tools increasingly participate in software development and review processes. Wiz disclosed the vulnerability to Snowflake through its HackerOne program on June 23, and the company patched it the same day.
Wiz's Red Agent identified the flaw in the "jira_issue.yml" workflow within Snowflake's "snowflake-connector-net" repository. The vulnerability stemmed from a code change introduced in pull request #1218, which modified how the workflow handled input from GitHub issue titles, enabling attackers to inject and run their own commands through the workflow. The flaw went live on June 18 when the pull request was merged and remained exploitable for five days before Red Agent discovered it. GitHub Copilot had acted as a co-author on the merged pull request and identified the code change as safe without spotting the critical security issues. GitHub Advanced Security scanned the final code revision and extracted the vulnerable workflow but also failed to flag the injection risk. The workflow included a safeguard designed to block exploitation by untrusted users, but that protection proved ineffective because it was designed for pull requests while the actual exploit involved handling issues.
According to Wiz researchers, "Copilot was a co-author that checked the merged PR and code change, and identified it as all-clear without noticing the critical vulnerabilities." Red Agent's first exploitation attempt failed because of a syntax error, but the autonomous tool then examined the error, adjusted its attack payload, and successfully executed the exploit on its second try without human intervention. The successful attack caused the GitHub Actions runner to transmit an out-of-band callback containing base64-encoded Jira credentials, which Wiz used to authenticate to Snowflake's internal Atlassian environment and gain read access to engineering, security compliance, and bug bounty projects. Wiz co-founder and CTO Ami Luttwak noted that "in a world where multiple agents run on every PR, scan it and update it, clear attribution between humans and AI is becoming a bit harder to establish." A Snowflake spokesperson confirmed the vulnerability "was immediately investigated and remediated, and our investigation found no evidence of unauthorized access."
The vulnerability exposed fundamental gaps in how AI-assisted code review tools detect security flaws introduced during the development process, particularly when multiple AI agents participate in creating and reviewing code changes. Snowflake rotated the compromised Jira credential on June 24, one day after patching the workflow to restore safer input-handling patterns. The company's forensic investigation found no evidence that anyone besides Wiz accessed the exposed credentials during the five-day window when the vulnerability was active. Wiz confirmed it securely deleted all data accessed during its proof-of-concept testing. Organizations relying on AI coding assistants may need to implement additional security layers specifically designed to catch vulnerabilities that current AI review tools overlook, especially as the line between human-written and AI-generated code becomes increasingly difficult to trace.