As part of ongoing security research conducted through Snowflake’s HackerOne vulnerability disclosure program, Wiz Research’s “Red Agent”—an autonomous, AI-powered security research tool—identified a critical GitHub Actions workflow vulnerability in one of Snowflake’s public repositories.
This incident highlights a rapidly emerging reality in software development:how AI coding assistants can inadvertently introduce workflow injection vulnerabilities, and how automated AI agents can rapidly surface them in the wild.
Upon responsible disclosure on June 23, 2026 by Wiz, Snowflake remediated the vulnerability on the same day, rotated the affected credential, and verified via detailed audit logs that Wiz was the sole actor during the exposure window. Wiz confirmed that all data accessed during proof-of-concept testing was securely deleted.
Wiz Red Agent identified a script injection vulnerability insnowflakedb/snowflake-connector-net. The issue allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner by opening a GitHub issue with a specially crafted title.
Crucially, the vulnerability was introduced on June 18, 2026—just five days prior to discovery—via a commit co-authored byCopilot Autofix powered by AI(PR #1218). The AI assistant removed the repository’s existing sanitized input pattern and replaced it with direct string expansion in a shell script.
Wiz Red Agent’s CI/CD capability scanned Snowflake’s GitHub organization and flagged thejira_issue.ymlWorkflow insnowflakedb/snowflake-connector-netas vulnerable to script injection via untrusted input inrun:blocks.
AI Assistant (Github Copilot) Change
The workflow triggered onissues: opened- meaning any GitHub user could fire it by opening an issue – and interpolated the attacker-controlled issue title directly into a shell script:
Thesedescaping runs after GitHub’s template expansion, a single quote in the title breaks out ofecho ‘…’and allows arbitrary command execution.
The injectable pattern was introduced just days earlier, on June 18, 2026,commit 4a1b8ce(PR #1218: “SNOW-2069227: Update jira workflows”) – co-authored byCopilot Autofix powered by AI.
It removed the repository’s existing safe pattern, which passed the issue title through anenv:variable and built the JSON payload withjq. Instead it used the direct${{ github.event.issue.title }}interpolation shown above. In other words, an AI “autofix” commit created the very injection vector.
The workflow had anif:condition that appeared protective: