AI 'Autofix' Planted a CI/CD Injection in Snowflake — an AI Agent Found It in 5 Days

Wiz’s autonomous “Red Agent” discovered and exploited a script-injection flaw in Snowflake’s public snowflake-connector-net repository, then used the stolen credential to read the company’s internal Jira. The bug lived in a GitHub Actions workflow that fired whenever anyone opened an issue and dropped the attacker-controlled issue title straight into a shell command. A supposed safety gate offered no protection: it checked github.event.pull_request, which is always null on issue events, so every user sailed through. A crafted title with a single quote broke out of the echo statement and executed arbitrary commands on the runner, exfiltrating a Jira token that authenticated as [email protected] across engineering, security-compliance, and bug-bounty projects.

The origin of the flaw is the notable part. The vulnerable code was introduced by PR #1218, whose squash commit credits “Copilot Autofix powered by AI” as co-author. That change stripped out an existing safe pattern — passing the title through an env variable and building the JSON payload with jq —arg — and replaced it with direct string interpolation, the exact anti-pattern the original code was written to avoid. GitHub’s own AI-assisted review looked at the merged change and marked it clean. On the offensive side, Wiz’s agent showed comparable autonomy: when its first payload triggered a bash syntax error, it read the error, rewrote the injection from a # comment to a ; echo ’ break, and landed the callback within seconds — no human in the loop.

The timeline is the warning. The flaw was live for just five days before an automated agent found, validated, and scoped it. Snowflake patched the same day it was reported via HackerOne, rotated the token, and confirmed through audit logs that only Wiz touched the endpoint during the exposure window. The broader lesson is that AI coding assistants lack the historical context for why a defensive pattern exists and can silently regress it, while AI reviewers miss the result — so machine-generated PRs need the same static analysis and guardrails as human code, paired with short-lived credentials and fast patch cycles to survive a world where discovery now happens in hours.