Wiz AI agent exposes Snowflake Jira credentials via GitHub Copilot autofix flaw
Snowflake patched the vulnerability and rotated credentials on the same day as responsible disclosure, with forensic logs confirming no external compromise during the five-day exposure window.
Wiz Research’s autonomous AI security tool, Red Agent, has identified a critical script injection vulnerability within a public Snowflake GitHub repository. The flaw, located in the snowflakedb/snowflake-connector-net repository, allowed unauthenticated users to execute arbitrary commands via specially crafted GitHub issue titles, potentially exposing Jira credentials.
The vulnerability was introduced on 18 June 2026 through a commit co-authored by GitHub Copilot Autofix. This AI-powered coding assistant replaced an existing secure input sanitisation pattern with direct string interpolation in the jira_issue.yml workflow. Specifically, the tool removed a safe pattern that utilised env: variables and jq for JSON payload construction, substituting it with direct expansion of the github.event.issue.title variable.
Red Agent’s CI/CD capabilities flagged the workflow as vulnerable to script injection. The workflow triggered on issue events, meaning any GitHub user could initiate the process. An analysis of the protective if: condition revealed it was ineffective, as github.event.pull_request is always null during issue events, causing the condition to evaluate as true for all users.
During testing, Red Agent autonomously adjusted its payload after encountering a bash syntax error. The agent shifted from using a comment character to a semicolon and echo command to properly close the shell block, successfully exfiltrating base64-encoded credentials. The token authenticated as [email protected] to snowflakecomputing.atlassian.net, granting read access to engineering, security compliance, and bug bounty tracking projects.
Snowflake remediated the issue and rotated credentials on 23 June 2026, following responsible disclosure via the HackerOne program. Forensic audit logs confirmed that no external third parties accessed the endpoint during the five-day exposure window, with all anomalous queries matching Wiz’s testing IPs. Public disclosure is scheduled for 25 July 2026, in accordance with Snowflake’s 30-day disclosure policy.
