Published: August 18, 2026
GitHub Copilot Autofix introduced a script injection vulnerability into Snowflake’s open-source GitHub Actions workflow on June 18, 2026, by removing the repository’s existing input sanitization and replacing it with direct shell string expansion. Wiz’s autonomous Red Agent found and exploited the flaw five days later without human guidance, gaining read access to Snowflake’s internal Jira including its engineering, security compliance, and bug bounty projects. Snowflake patched the workflow the same day Wiz reported it and found no evidence of unauthorized external access.
What Copilot Autofix Changed — and Why It Mattered
Copilot Autofix co-authored pull request #1218 (“SNOW-2069227: Update jira workflows”) against Snowflake’s public GitHub repository on June 18, 2026. The change modified .github/workflows/jira_issue.yml: Copilot removed the existing sanitized input pattern and substituted direct string expansion inside a shell script.
The workflow triggered on any public GitHub issue open event. It exposed three credentials — JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN — to the same workflow step that processed user-supplied issue titles. Any GitHub user who could open an issue could, in principle, craft a title that broke out of the echo string and redirected those credentials to an external server.
The vulnerability is a standard script injection pattern — well-documented in CI/CD security literature — but Copilot introduced it while appearing to improve the workflow. The existing sanitization had specifically prevented this class of attack. The AI removed it.
How Wiz Red Agent Exploited the Flaw Without Human Guidance
Wiz Red Agent, Wiz’s autonomous penetration-testing agent, identified the vulnerable workflow and acted on June 23, 2026 — five days after the PR merged. According to Gal Nagli at Wiz: “We crafted an issue title that, after template expansion, breaks out of the echo string and exfiltrates the Jira credentials via an out-of-band callback.”
Wiz reported the full sequence: “Wiz Red Agent independently discovered and exploited a GitHub Actions injection missed by GitHub’s AI review, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius — all without human intervention.” The agent confirmed read access to Snowflake’s engineering Jira, security compliance project, and bug bounty tracking project before reporting via HackerOne (report #3819931) on the same day.
Snowflake patched the workflow that day. Its own investigation found no evidence that an external actor — other than Wiz — had accessed the credentials before remediation.
What This Means for Businesses Using AI Coding Tools
This incident is the first documented case of GitHub Copilot Autofix introducing a script injection vulnerability by removing existing protections. The risk it exposes is not that AI coding tools produce obviously broken code — it is that they can silently degrade security posture while producing working, reviewable-looking changes.
The specific attack surface — GitHub Actions workflows that echo user-supplied input inside shell steps — is common across open-source and enterprise repositories. Any company using Copilot Autofix in CI/CD pipelines should audit recent AI-assisted commits for removed or simplified input validation. The pattern of Autofix substituting a cleaner-looking idiom that happens to be exploitable is unlikely to be unique to this workflow.
The Wiz Red Agent side of this story illustrates a separate point. For AI agents applied to business security operations, autonomous red-teaming can surface vulnerabilities in a five-day window that would otherwise sit open for weeks. The same capability that Wiz used for responsible disclosure is available to adversaries — which is the business case for deploying AI security agents as a continuous control, not a periodic exercise. For a broader view of how AI agents are applied across functions, see 15 AI Agent Examples Across Industries.
AI code review tools and AI coding assistants — including GitHub Copilot versus alternatives — are evaluated primarily on correctness and speed. This case adds a third criterion: whether the tool’s suggestions preserve, degrade, or improve the security properties of existing code. That evaluation requires human or automated review that specifically checks what the AI removed, not only what it added.
For Context
Earlier coverage on AI agents and security risks:
- Anthropic’s AI Agents Started a Turf War — With Self-Replicating Malware — prior research documenting how AI agent interactions can produce emergent adversarial behaviour.
- Humans Miss 1 in 3 AI Agent Threats, 40,000-Run Study Finds — why human oversight alone is insufficient for catching AI agent security failures at scale.
