AI Security Agent Exploited Snowflake's Internal Jira Through a Copilot-Approved Flaw

One of the strangest cybersecurity stories of the year surfaced on August 17, 2026, when Wiz disclosed that its autonomous AI security agent, Red Agent, discovered and exploited a real vulnerability in a Snowflake open-source repository, reached the company's internal Jira, and exfiltrated sensitive credentials — entirely without human intervention. The detail that pushed the story to the top of every security feed: the code that opened the door had been checked and approved by Copilot, Microsoft and GitHub's AI coding assistant.

What exactly happened?

Security researcher Gal Nagli of Wiz Research documented the full chain in an official blog post. The target was the public repository snowflake-connector-net, Snowflake's connector for .NET, and specifically a GitHub Actions workflow file named jira_issue.yml.

The flaw is a textbook script injection — untrusted input flowing into a shell run: block. The analysis showed that pull request #1218, merged as squash commit 4a1b8ce, replaced a safe pattern that passed the issue title through an environment variable with jq --arg, substituting direct interpolation of ${{ github.event.issue.title }} into a shell echo. The consequence: a single quote in a GitHub issue title is enough to break out of the string and execute arbitrary commands.

The irony that made the story viral is that the merged commit carries an automated co-author signature reading "Copilot Autofix powered by AI," and Copilot reviewed the pull request, approved it, and gave it the all-clear before merge. The supposed safety gate was also silently broken: the workflow's if: condition checked github.event.pull_request.user.login, a field that is always null on issue events — meaning the check always passed. Wiz notes it is unclear whether the dangerous change itself was AI-written; what is documented is that Copilot's automated review sailed right past it.

The autonomous attack chain, step by step

The sequence Wiz published reveals an agent operating with genuine research autonomy:

1. Discovery. Red Agent's CI/CD scanner flagged the vulnerable workflow pattern during automated scanning of public repositories.
2. First attempt — and failure. The agent opened a GitHub issue with a crafted title as its injection payload. The first try failed with a bash "unexpected EOF" error, because its payload used # to comment out trailing syntax — which also swallowed the closing ) of the TITLE=$(...) assignment.
3. Self-diagnosis. With no human in the loop, the agent read the error, understood the cause, and rewrote its payload using ; echo ' to properly close the shell block.
4. Exfiltration. The successful payload exfiltrated three base64-encoded secrets to an out-of-band oast.me listener (callback from Azure IP 20.106.182.197): JIRA_API_TOKEN, JIRA_USER_EMAIL, and JIRA_BASE_URL.
5. Access. The stolen token authenticated as [email protected] to snowflakecomputing.atlassian.net, granting read access to engineering, security compliance, and bug bounty tracking projects.

Source: Wiz Blog — Red Agent Snowflake Copilot CI/CD bug

The full disclosure timeline

The most important number in the table is the exposure window: the vulnerability lived just five days from merge to report and patch. Snowflake's forensic audit logs confirmed Wiz was the sole actor during the window, with no evidence of unauthorized third-party access, and all PoC-accessed data was securely deleted by the researchers.

Snowflake's public response thanked Wiz and stated the report "was immediately investigated and remediated," with the investigation finding no evidence of unauthorized access. No GitHub or Microsoft response appears in the post as of publication.

Source: Wiz Blog — Red Agent Snowflake Copilot CI/CD bug

Why this story is bigger than one bug

This is not merely a patched vulnerability. It is a working miniature of three shifts every engineering and security organization now faces.

First: AI is discovering AI's mistakes. Machine-merged code with automated review failed to catch an exploitable flaw, and a different AI agent found it and proved the impact autonomously. A cycle that used to require a human research team and weeks of effort completed in automated sessions. It intersects a trend we have documented all year — from Anthropic's disclosed cybersecurity evaluation incidents to OpenAI's warnings about its Astra model approaching the Critical cyber capability threshold and the security incidents surrounding third-party evaluations of its models.

Second: discovery windows are collapsing. When human attackers scanned open-source repositories manually, vulnerabilities could live for months before anyone exploited them. When the scanner is an AI agent running around the clock, the average life of an unnoticed flaw shrinks to days or hours. Wiz's own conclusion is blunt: rapid patching and short-lived credentials are no longer security hygiene niceties — they are survival requirements.

Third: AI-generated code deserves the same review as human code — no less. The failure here was not Copilot's ability to generate code; it was a team treating an automated review gate as sufficient grounds to skip human review. The most precise technical lesson from the story: block AI agents from swapping structured parsers — environment variables plus jq --arg — for direct string interpolation. That single pattern is what turned an innocent issue title into executable commands.

What this means for you

If you run an engineering or security team, three actions belong on this week's list, not next month's. Audit every GitHub Actions workflow for direct interpolation of github.event values inside shell blocks — static analysis tooling flags this in minutes. Enforce short-lived access tokens so a single leaked credential is not an extended-access window. And redefine your automated merge gate so a mandatory human reviewer remains for any change touching workflows or infrastructure, no matter how green the automated check looks.

Honest caveats

• No actual damage occurred: the access was a proof of concept within responsible disclosure, data was deleted, and there is no evidence of third-party exploitation.
• "Copilot caused it" is inaccurate: what Wiz documented is that Copilot reviewed and approved the code — whether it authored the dangerous line remains unresolved.
• The threat model is specific: this was a CI/CD workflow flaw in one open-source repository; it does not generalize to every Copilot use.
• The researcher has a market interest: Wiz sells cloud security tooling. That does not diminish the documented research, but it is context worth having.

Frequently asked questions

Was Snowflake's production system breached?

No. The access used a QA account token ([email protected]) against the internal Jira with read permissions to engineering, compliance, and bug bounty projects, within a responsible disclosure. Snowflake confirmed no evidence of unauthorized access by any third party.

What was Copilot's role in the vulnerability?

The pull request that introduced the dangerous code carries a Copilot Autofix co-author signature, and Copilot reviewed and approved the merged PR without flagging the flaw. Whether Copilot wrote the vulnerable line itself is explicitly left unresolved by Wiz.

Could this attack be repeated on other repositories?

Yes, in principle. Command injection via issue titles in GitHub Actions workflows is a known, classified pattern in workflow security guidance, detectable by static analysis, and preventable by never interpolating event inputs directly into shell blocks.

What is Red Agent?

An autonomous offensive-security research agent built by Wiz that discovers, tests, and exploits vulnerabilities to prove impact without human intervention. It executed this entire chain from scanning through access demonstration on its own.

What should teams do immediately?

Scan all GitHub Actions pipelines for direct interpolation of event inputs into shell commands, scope and shorten the lifetime of every secret used in workflows, and keep a mandatory human reviewer for infrastructure changes regardless of automated check results.

Sources:
- Wiz Blog — Red Agent Snowflake Copilot CI/CD bug (August 17, 2026)
- Affected repository: snowflakedb/snowflake-connector-net on GitHub