Wiz Agent Exploits Snowflake Copilot Workflow Flaw
Wiz reported that its autonomous Red Agent discovered and exploited a GitHub Actions script-injection flaw in a public Snowflake repository on June 23, 2026. According to Wiz, the vulnerability was introduced five days earlier by a commit co-authored by GitHub Copilot Autofix, enabling crafted GitHub issue titles to execute commands on a workflow runner. Snowflake remediated the issue the same day and rotated the affected credential.
Wiz disclosed that its autonomous Red Agent discovered and exploited a critical GitHub Actions workflow vulnerability in a public Snowflake repository on June 23, 2026. The flaw enabled an unauthenticated user to execute arbitrary commands in a GitHub Actions runner through a specially crafted GitHub issue title, according to Wiz's research write-up.
Wiz reported the issue through Snowflake's HackerOne vulnerability disclosure program. Wiz states that Snowflake remediated the vulnerability the same day, rotated the affected credential, and used audit logs to verify that Wiz was the sole actor during the five-day exposure period. The Register separately reported that Snowflake patched the flaw on June 23 and rotated the Jira credential the following day.
Copilot Autofix introduced the vulnerable pattern
According to Wiz, the vulnerable code entered the repository on June 18 in a commit co-authored by Copilot Autofix powered by AI. The change removed an existing sanitized-input pattern and replaced it with direct string expansion within a shell-script run: block.
That pattern allowed issue-title content to be expanded into a shell command. Wiz head of threat exposure Gal Nagli told The Register that the researchers crafted an issue title which escaped an echo string after template expansion and sent Jira credentials through an out-of-band callback.
The resulting credentials gave the researchers read access to Snowflake Jira projects covering engineering, security compliance, and bug-bounty tracking, The Register reported. Wiz said it deleted data accessed during proof-of-concept testing.
A Snowflake spokesperson told The Register that the disclosure was investigated and remediated immediately, and that the company's investigation found no evidence of unauthorized access.
A CI/CD security lesson for AI-assisted changes
The case concerns a familiar CI/CD risk: untrusted event fields, including issue titles, pull-request metadata, branch names, and comments, can become command-injection inputs when interpolated into shell contexts. The notable element is the reported end-to-end automation: one AI-assisted code change introduced the unsafe expansion, while an autonomous security agent found, validated, and scoped the exposure.
For engineering teams, this incident reinforces established controls around GitHub Actions workflows:
- •Treat GitHub event payload fields as untrusted input.
- •Avoid direct expression interpolation in shell commands, especially in run: blocks.
- •Pass untrusted values through environment variables and quote them safely.
- •Apply least-privilege permissions and short-lived credentials to workflow jobs.
- •Review AI-generated remediation diffs for security regressions, not only functional correctness.
Comparable AI-assisted development workflows can accelerate fixes, but automated code review and workflow-specific security testing remain important safeguards when changes alter input handling or credential-bearing CI jobs.
Key Points
- 1Wiz found a GitHub Actions injection flaw in Snowflake code that allowed crafted issue titles to execute commands on a runner.
- 2According to Wiz, Copilot Autofix removed input sanitization five days before discovery, illustrating review risks in AI-assisted security fixes.
- 3Comparable CI/CD incidents show why teams should treat event metadata as untrusted and minimize workflow credential privileges.
Scoring Rationale
This is a notable real-world example of an AI-assisted code change introducing a CI/CD injection vulnerability, followed by autonomous discovery and exploitation. It is directly relevant to teams deploying coding assistants, GitHub Actions, and agentic security tooling, though the exposure was limited and remediated through coordinated disclosure.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
