AI Agent Autonomously Exploits Live Snowflake Vulnerability, Extracts Credentials in 5-Day Window

AI Agent Discovers and Exploits Live Flaw Autonomously

Wiz's Red Agent, an AI-powered autonomous attacker designed for offensive security, discovered a critical injection vulnerability in Snowflake's public GitHub repository on June 23, 2026. The autonomous AI agent not only identified the flaw in the snowflakedb/snowflake-connector-net repository but also crafted and executed an exploit that extracted working credentials1

1

. What makes this incident particularly significant is that the AI security tool operated entirely without human intervention, demonstrating how rapidly AI-assisted development environments can be both compromised and defended.

The vulnerability in Snowflake's GitHub Actions workflow allowed any unauthenticated user to execute arbitrary commands within a GitHub Actions runner simply by opening a GitHub issue with a specially crafted title1

1

. The flaw existed because the escaping mechanism sat in the wrong order—GitHub's template engine substituted the issue title first, and commands meant to sanitize it ran afterwards2

2

. This allowed a single quote in the title to break out of the shell string and enable command execution.

How the Autonomous Attack Unfolded

Wiz's red agent demonstrated remarkable adaptability during the attack. When its first payload used a hash character to comment out the rest of the line, the GitHub Actions runner threw a syntax error. The agent read the error, determined that the comment had swallowed a closing bracket, rewrote the payload, and tried again2

2

. The callback arrived within seconds, proving the autonomous nature of the exploit.

According to Gal Nagli, Wiz's head of threat exposure, the team "crafted an issue title that, after template expansion, breaks out of the echo string and exfiltrates the Jira credentials via an out-of-band callback"1

1

. The extracted credentials granted read access to Snowflake's engineering, security compliance, and bug bounty tracking projects—a significant AI-driven security breach that could have had serious implications if conducted maliciously.

Snowflake's Rapid Response and Investigation

Snowflake responded with impressive speed to the Snowflake vulnerability report. The company patched the workflow vulnerability the same day Wiz reported it on June 23, restored the safe pattern, and rotated the Jira token on June 241

1

2

2

. Audit logs confirmed that Wiz was the only third-party to access the endpoint during the five-day exposure window, with every anomalous query matching Wiz's own testing addresses.

"The disclosure was received on June 23, 2026, and it was immediately investigated and remediated, and our investigation found no evidence of unauthorized access," a Snowflake spokesperson confirmed2

2

. Snowflake emphasized its commitment to working with Wiz to share these learnings with the broader industry to encourage widespread adoption of security practices.

The GitHub Copilot Attribution Controversy

Initial reports suggested that GitHub Copilot Autofix, an AI coding assistant, had introduced the vulnerability. The commit that carried the flaw onto the main branch listed "Copilot Autofix powered by AI" among its co-authors, leading Wiz to initially claim an AI had written the vulnerable code1

1

. However, this claim unraveled within eight hours when investigators examined the underlying commits.

The co-author line turned out to be a squash merge artifact. When squashing commits, every commit in a pull request folds into one, and the co-author line came along for the ride2

2

. The actual unsafe refactor sits in a separate commit dated August 25, 2025, which GitHub attributes to a named Snowflake engineer. Copilot's co-authored commit changed a different file entirely.

GitHub ran an internal review and rejected the framing, stating that a human wrote the contributions that led to the vulnerability and that Copilot Autofix neither reviewed nor contributed to them2

2

. Wiz subsequently updated its post to clarify that "it's unclear whether the code-change was AI-assisted," acknowledging that Copilot was a co-author that checked the merged pull request without noticing the vulnerability but did not necessarily write the flaw itself.

Implications for AI Security and Vulnerability Detection

Despite the controversy over authorship, the core finding remains significant for AI security. An autonomous agent scanned a public repository, spotted a live injection vulnerability, wrote an exploit, encountered an error, diagnosed it, corrected itself, and extracted working credentials—all within a five-day window2

2

. This demonstrates that credential extraction and command execution by AI agents are no longer theoretical concerns but practical realities.

Nagli emphasized that "this incident highlights a rapidly emerging reality in software development: how AI coding assistants can inadvertently introduce workflow injection vulnerabilities, and how automated AI agents can rapidly surface them in the wild"1

1

. The speed at which Wiz's autonomous AI agent operated underscores that human code review alone isn't sufficient to quickly detect vulnerabilities, especially as developers increasingly rely on AI-assisted development tools.

Watch for continued evolution in both offensive and defensive AI capabilities, as the five-day discovery-to-exploitation timeline suggests attackers may soon operate at speeds that outpace traditional security practices and vulnerability detection methods.