AI Agent Autonomously Exploits Live Snowflake Vulnerability, Extracts Credentials in 5-Day Window

An AI broke Snowflake's code. Then another AI agent exploited it

An AI broke Snowflake's code; then another AI, an attack agent, autonomously found the bug, exploited it, and extracted credentials without human intervention. Luckily, this wasn't yet another case of rogue AI agents doing evil things. It was a sanctioned bug hunt, conducted through Snowflake's HackerOne vulnerability disclosure program, and Snowflake fixed the flaw the same day Wiz reported it and rotated the affected credentials the following day. Wiz's red agent, an AI-powered autonomous attacker designed for offensive security, found the GitHub Actions workflow flaw during a routine scan of public repositories on June 23. The script injection vulnerability existed in snowflakedb/snowflake-connector-net, and it allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner by opening a GitHub issue with a specially crafted title. And it turned out an AI had inadvertently injected the bug into the code five days earlier. GitHub Copilot Autofix, an AI coding assistant, co-authored the commit on June 18, and it introduced a script injection bug in run: blocks by removing the repository's existing sanitized input pattern and replacing it with direct string expansion in a shell script. "We crafted an issue title that, after template expansion, breaks out of the echo string and exfiltrates the Jira credentials via an out-of-band callback," Wiz's head of threat exposure Gal Nagli said in a Monday blog. These credentials gave Wiz read access to Snowflake's engineering, security compliance, and bug bounty tracking projects. Wiz reported the workflow vulnerability to the cloud data platform on June 23, and Snowflake patched it the same day. It also revoked and rotated the Jira token, and confirmed, via audit logs, that Wiz was the only third-party to access the endpoint during the five-day exposure window. The disclosure "was immediately investigated and remediated, and our investigation found no evidence of unauthorized access," a Snowflake spokesperson told The Register. "We are working together with Wiz to share these learnings with the broader industry to encourage widespread adoption of these security best practices." Wiz, for its part, deleted all of the data it accessed during the vulnerability research and proof-of-concept exploit testing, and told us that this incident proves human code review isn't sufficient to quickly detect vulnerabilities - especially as developers increasingly use AI. "This incident highlights a rapidly emerging reality in software development: how AI coding assistants can inadvertently introduce workflow injection vulnerabilities, and how automated AI agents can rapidly surface them in the wild," Nagli wrote. Of course, the Google-owned biz has a vested interest in saying this. But this doesn't make it not true.®

Copilot Autofix did not write the Snowflake flaw, GitHub say

Wiz's autonomous agent really did find and exploit a live flaw in five days. The claim that GitHub's AI wrote that flaw unravelled within eight hours, and it rested on a git trailer. A security company said on Monday that an AI wrote a critical flaw into Snowflake's code, and that another AI found it and broke in. The second half holds up. The first half came apart in about eight hours. What is left is still worth your attention. It is just not the story that travelled. What the agent actually did Wiz Research runs an autonomous tool it calls Red Agent. It scanned Snowflake's GitHub organisation under the company's HackerOne disclosure programme and flagged a workflow file in the public repository for Snowflake's .NET connector. The workflow ran whenever anyone opened an issue. It dropped the issue title straight into a shell script. Any account on the internet could reach it. The escaping sat in the wrong order. GitHub's template engine substituted the title first, and the commands meant to sanitise it ran afterwards. A single quote in the title therefore broke out of the shell string. A guard condition looked protective. It compared a pull request property against a bot name, but on issue events that property does not exist. GitHub evaluates a missing property as an empty string, so the comparison always returned true and every user walked through. Then the part that matters. Red Agent's first payload used a hash character to comment out the rest of the line, and the runner threw a syntax error. The agent read the error, worked out that the comment had swallowed a closing bracket, rewrote the payload, and tried again. The callback arrived within seconds. Nobody touched a keyboard. The token it pulled out granted read access across Snowflake's engineering, security compliance, and bug bounty projects. Snowflake moved the same day Wiz reported the flaw on 23 June. Snowflake patched it that day, restored the safe pattern, and rotated the Jira token on 24 June. Audit logs matched every anomalous query to Wiz's own testing addresses. Wiz says it deleted what it took. "The disclosure was received on June 23, 2026, and it was immediately investigated and remediated, and our investigation found no evidence of unauthorized access," Snowflake said. The co-author line is a squash artefact Here is where it went wrong. The commit that carried the flaw onto the main branch lists "Copilot Autofix powered by AI" among its co-authors. Wiz read that as an AI writing the vulnerable code. Its own post said an AI autofix commit created the injection vector. Most coverage followed. The Hacker News went and read the commits underneath. Copilot's co-authored commit changed a different file. The unsafe refactor sits in a separate commit dated 25 August 2025, which GitHub attributes to a named Snowflake engineer. Squashing folds every commit in a pull request into one. The co-author line came along for the ride. It records participation in the pull request, not authorship of the lines that broke. Reporter Swati Khandelwal put it plainly: the history confirms Copilot took part, and does not establish that it wrote the flaw. GitHub's answer GitHub ran an internal review and rejected the framing. It says a human wrote the contributions that led to the vulnerability, and that Copilot Autofix neither reviewed nor contributed to them. Wiz softened its own post the same evening. An update timestamped 19:57 UTC now says Copilot was a co-author that checked the merged pull request and called it clear without noticing the vulnerability. Then it adds the sentence that undoes the headline: "It's unclear whether the code-change was AI-assisted." The Register had already published. By midnight it had changed its headline from an AI breaking the code to an AI failing to detect it, and appended a correction. Cybersecurity editor Jessica Lyons ended it with a line you do not often see about a major vendor. "The Register regrets this error, has updated this story to reflect the revised information, and won't be trusting Wiz for a very long time." Two owners worth naming Google owns Wiz. Microsoft owns GitHub, and Copilot with it. That does not make the research wrong. It does mean a Google-owned firm published a claim that a Microsoft product wrote a critical flaw, then withdrew the load-bearing part of it once people checked. What survives, and it is not small Strip out the disputed half and a real finding remains. An autonomous agent scanned a public repository, spotted a live injection, wrote an exploit, hit an error, diagnosed it, corrected itself, and took working credentials. The flaw was live for five days. That was the entire window. We have been tracking this curve. Researchers jailbroke Copilot workflows in July, and a separate GitHub agent leaked private repositories a day earlier. Since then AI-discovered flaws have moved into real exploitation. Yesterday we reported that an agent built a working exploit for a macOS flaw in four hours. Greg Brockman conceded on Sunday that OpenAI had underestimated its own models on exactly this. The direction of travel is not in question. What the record does not show Several things remain unestablished, and the gap matters given how the claim spread. No CVE exists. No CVSS score, and no entry in the US catalogue of exploited vulnerabilities. The weakness sat in repository automation, so no connector release carried it, and no evidence points to anyone else exploiting it. Snowflake's audit logs are not public. Neither are the Jira permissions or the workflow run. Everything about the blast radius rests on what Snowflake and Wiz say they saw. One more detail deserves a mention. GitHub published guidance in July 2025 warning against exactly this pattern, a month before the commit that introduced it. What would settle it The useful question is not which AI to blame. It is whether GitHub's AI review looked at this change and passed it. Wiz says it did. GitHub says Copilot Autofix never reviewed the code at all. Those cannot both be true, and only one company holds the logs that would show it.