AI-generated code, AI-driven exploit

On June 18, 2026, a commit merged into Snowflake's public repository contained a shell injection vulnerability in its own CI/CD pipeline. The code had not been written by hand — it had been generated and reviewed by GitHub Copilot Autofix, GitHub's own automated vulnerability remediation feature, powered by generative AI. Five days later, Wiz Red Agent, an autonomous security agent, discovered the vulnerability, exploited it, and gained access to Jira credentials running on GitHub Actions runners.

What happened is a rare milestone in software security: two AI systems acting in sequence — one introducing a flaw, another finding and exploiting the same flaw — and one of the world's most important data companies as the consequence.

The vulnerability

The commit in question was part of an apparently legitimate security patch. The PR was generated by Copilot Autofix after a CodeQL alert identified a potential vulnerability in the `jira_close.yml` workflow, a file responsible for automatically closing Jira tickets when a pull request was merged. What Autofix did was replace an old dependency — an Atlassian Jira action that relied on the `gh-actions` repository — with direct calls to the Jira API using curl.

The change seemed sensible in theory: eliminate external dependencies, simplify the flow. But the AI model did not understand that the new implementation did not adequately escape an input parameter used in building the request URL. Who merged the PR — likely a human trusting the recommendation — did not realize they were introducing a new shell injection vector.

The problem was not in Snowflake's core application code. It was in the internal integration tools the company uses to manage its own development workflow. That is precisely where the flaw hid: in workflows that security teams rarely audit because they treat as internal infrastructure, not as production software.

The discovery

Wiz Red Agent is an autonomous auditing tool from Wiz Research — basically, an AI agent specialized in testing the security of public repositories. Unlike traditional scanners that look for known vulnerability patterns, Red Agent is designed to think in terms of exploitation chains: if I were to attack this company, where would I enter?

On June 23, the agent analyzed Snowflake's public repository and noticed that the `jira_close.yml` workflow could be manipulated through the title of a GitHub issue. The issue title was passed directly to curl without sanitization — and since GitHub exposes that value to other workflows, the agent could inject commands that would execute on the CI/CD runner.

From there, the exploitation was straightforward. The GitHub Actions runners ran inside Snowflake's environment and had environment variables containing Jira credentials. By executing injected commands, Red Agent accessed those credentials, validated access to the internal Jira system, and confirmed it could read sensitive engineering team data.

The full Wiz report, published on August 17, details that the agent did nothing beyond what a legitimate auditor would need to do: exploit the trust chain between GitHub Issues and the CI/CD pipeline to demonstrate that a real attacker could do the same. Snowflake suffered no data loss in the event — Red Agent only read credentials, modified nothing — but the fact that the vulnerability existed for five days without detection is alarming.

Why it matters

This incident reveals a pattern that is likely to repeat as the adoption of generative AI in software development accelerates. Tools like Copilot Autofix are designed to reduce the time to remediate vulnerabilities — GitHub claims median fix time dropped from 90 minutes to 28 minutes during beta testing. It is an impressive metric and, in many cases, valid for trivial bugs like uninitialized variables or incorrect types.

But when the context is code that interacts with external APIs, configures pipelines, or handles authentication, the AI operates in the most dangerous territory: it understands the syntax, but not the intent. The model saw a security alert and generated a fix that appeared to solve the problem at the source-code level. What it missed was that the fix created a brand-new attack vector in layers the model did not even know existed.

It is not that Copilot Autofix is failing in a unique way — it is the trust automation paradigm. When developers begin to systematically trust AI-generated fixes, especially in infrastructure code, they are automating the introduction of vulnerabilities at scale. The difference this time is that the tool that discovered the flaw was also an AI.

Snowflake has already fixed the workflow and Wiz responsibly disclosed the report without exposing details that could be reproduced. The lesson is broader: as the industry integrates AI into every stage of the development cycle — from writing to patching vulnerabilities — the same security principle must apply: verify AI-generated code with at least the same rigor (or more) that you would verify any third-party contribution. Code written by a machine is no less risky than code written by a human. It is merely risky in a different way.

Sources: Wiz Blog, dev.to, TechTarget

✓ Independent sources cross-checked and verified before publishing