A security vulnerability introduced by GitHub Copilot Autofix left a public Snowflake repository vulnerable to unauthenticated remote command injection for five days before an autonomous security agent discovered and exploited it, according to a technical disclosure published by Wiz Research on August 17, 2026.
The incident highlights emerging operational risks at the intersection of automated code generation and CI/CD security, demonstrating how automated remediation bots can silently strip out existing security patterns during code updates.
How Copilot Autofix Removed Input Sanitization
The flaw originated in jira_issue.yml, an automated GitHub Actions workflow in snowflakedb/snowflake-connector-net, the open-source repository for Snowflake's .NET data connector. The workflow was designed to run whenever a new issue was opened in the repository.
Prior to the change, the workflow safely handled untrusted user input by passing the issue title into an environment variable and parsing the payload using jq --arg, preventing direct execution in the shell.
On June 18, 2026, Snowflake merged pull request #1218 ("SNOW-2069227: Update jira workflows"), which included a commit co-authored by GitHub Copilot Autofix, the automated remediation engine in GitHub Advanced Security. The AI-suggested code replaced the structured parser with direct shell interpolation:
TITLE=$(echo '${{ github.event.issue.title }}' | sed 's/"/\\"/g' | sed "s/'/\\\'/g")Because GitHub Actions expression substitution (${{ ... }}) occurs before the shell executes the line, any single quote in an issue title closed the echo '...' construct prematurely. Any subsequent characters were executed directly as bash commands on the runner.
The workflow also included an invalid conditional check designed to filter triggers:
if: (github.event_name == 'issues' && github.event.pull_request.user.login != 'whitesource-for-github-com[bot]')Because github.event.pull_request is always null for issues events, the expression evaluated to true for every incoming issue, allowing any GitHub user to trigger the pipeline without authentication.
Autonomous Detection and Credential Exfiltration
On June 23, 2026, Wiz's autonomous security research system, designated "Red Agent," identified the vulnerable workflow while operating within Snowflake's HackerOne bug bounty program.
The agent constructed an exploit payload targeting the injection point. When the initial attempt failed due to a bash syntax error caused by an unclosed subshell parenthesis, the agent parsed the runner error output, revised its syntax, and submitted a second payload.
The modified exploit executed on the Azure-hosted GitHub Actions runner and transmitted environment variables back to an out-of-band listener. The exfiltrated data included JIRA_API_TOKEN, JIRA_USER_EMAIL, and JIRA_BASE_URL. The recovered token granted read access to Snowflake's Jira instance, covering engineering tickets, compliance tracking, and bug bounty disclosures.
Remediation and Industry Implications
Snowflake responded to the HackerOne disclosure on June 23, merging pull request #1402 to restore the env: variable mapping and jq --arg sanitization. The company rotated the exposed Jira credentials on June 24.
In a statement included in the Wiz disclosure, Snowflake stated that internal audit logs confirmed no unauthorized third parties accessed the exposed endpoint during the five-day window between June 18 and June 23. Wiz confirmed it deleted all data retrieved during testing.
The disclosure provides a concrete case study of AI-generated code bypassing human review and eroding defensive patterns. Wiz recommended that engineering teams subject AI-suggested pull requests to strict static analysis, enforce restrictions against direct expression interpolation in CI/CD scripts, and reduce credential lifetimes in automated pipeline runners.
