Copilot's AI "autofix" opened a hole in Snowflake's Jira

Researchers at Wiz have described a telling incident: a vulnerability in a public Snowflake repository was created not by a human, but by the AI assistant GitHub Copilot Autofix. It was discovered and confirmed by a machine as well — Wiz's own autonomous "Red Agent," operating under the HackerOne vulnerability disclosure program.

How a "fix" became a hole

On June 18, 2026, a commit appeared in the snowflake-connector-net repository, co-authored by Copilot Autofix. The AI removed an already existing safe practice — the GitHub issue title had been passed through an environment variable, with the JSON assembled by the jq --arg utility — and replaced it with direct interpolation of ${{ github.event.issue.title }} into the shell script. The sed escaping, meanwhile, ran only after GitHub's template substitution, so a single quote in the title broke out of the echo string and allowed an arbitrary command to run.

The workflow triggered whenever any issue was opened, meaning anyone could set it off. The existing if: condition, which looked like a safeguard, actually checked github.event.pull_request — a field that is always empty for issue events, so every request passed the check without exception.

The agent that fixed its own exploit

The Wiz Red Agent scanned Snowflake's GitHub organization, flagged the workflow as vulnerable, and crafted an issue title that stole Jira credentials via an external callback. A curious detail: the first attempt used the comment character #, which caused the runner to throw a bash syntax error — the comment "ate" the closing parenthesis. The agent didn't stop: it parsed the error itself, rewrote the payload using ; echo ', and within seconds received a callback carrying base64-encoded data.

The stolen token belonged to the qa@snowflake.net account and granted read access to internal Jira projects — engineering, compliance, and bug bounty.

Response and takeaways

Snowflake reacted the same day, June 23: it closed the vulnerability by restoring the safe template with env: and jq, and the following day it revoked and replaced the token. An audit confirmed that during the five-day window only Wiz had accessed the endpoint, and that all test data had been deleted.

Wiz frames three lessons. AI-generated code must go through the same static analysis and security review as human-written code. The window between a vulnerability's appearance and its automated discovery is shrinking rapidly — here it was just five days, which calls for short-lived secrets and fast patching. Finally, AI assistants don't know a codebase's history and so readily reintroduce dangerous patterns that people once deliberately removed — and guarding against this requires dedicated defensive mechanisms.

Source: Hacker News