Wiz Red Team AI Discovers Snowflake Vulnerability Tied to Copilot Autofix; GitHub Denies AI Involvement

On June 18, 2026, a PR merge in Snowflake's snowflakedb/snowflake-connector-net repository brought a GitHub Actions workflow with script injection risk into production. PR #1218 modified the jira_issue.yml file, inserting the issue title directly into an echo statement in a shell command, with sed escaping applied after GitHub template expansion. Any user could break out of the quote constraints and execute arbitrary commands by simply submitting an issue title containing single quotes.

How the Vulnerability Formed

The original secure approach stored issue titles in environment variables and used jq to construct JSON. The modification switched to direct template interpolation, allowing attackers to craft payloads that execute commands on the runner. Wiz's Red Agent discovered the issue on June 23 through a HackerOne program scan, successfully extracted Jira tokens, and accessed engineering and compliance projects. Snowflake completed the fix and rotated credentials the same day, with audit logs showing only Wiz had accessed the system during the exposure window.

GitHub Advanced Security scanned the final PR version but did not flag the injection risk.

The Verification Gap in AI Toolchains

Copilot Autofix was listed as a co-author on the PR and reviewed changes to jira_close.yml, but it did not recognize the injection pattern in jira_issue.yml. GitHub's subsequent internal review stated that the code change introducing the vulnerability was made by a human and did not go through Copilot review or contribution. This account differs from Wiz's report describing "Copilot Autofix as a co-author."

At the core of the incident is the lack of targeted checks in existing security scanning tools for AI-assisted code. The ordering issue between template interpolation and shell escaping is a classic injection pattern, yet it was not caught by automated tools. Red Agent, however, quickly completed the entire process from syntax error analysis to effective payload tuning after the vulnerability went live.

Chain Effects at the Industry Level

AI coding tools have entered real development workflows, and Copilot Autofix's goal is to automatically fix issues found by scans. But when the fix itself introduces new vulnerabilities, and subsequent scans fail to detect them, the chain of trust breaks. Developers may assume AI suggestions have been verified, when in reality they rely on manual secondary review.

• CI/CD pipelines have become high-value attack surfaces—any user can trigger execution through a public issue.
• Autonomous security agents can complete discovery and exploitation within days, far faster than traditional manual processes.
• GitHub and third-party AI security tools reached divergent conclusions on the same code change, exposing inconsistent evaluation standards.

Similar cases show that AI-generated code should be held to the same or higher security review standards as human-written code. Current toolchains have blind spots when handling combinations of template interpolation, environment variables, and command construction.

Subsequent Assessment

The way this vulnerability was introduced and discovered shows that the actual security boundary of AI-assisted development depends on how well scanning tools cover new code patterns. GitHub denies that AI made specific contributions, but that does not change the fact that the workflow was modified and deployed. Going forward, independent verification processes for AI-generated snippets will be needed, rather than relying solely on existing static analysis rules.