TITLE: AI Agent Hacked Snowflake's Pipeline Before GitHub's Tools Caught the Bug DATE: Wed Aug 19 2026 00:00:00 GMT+0000 (Coordinated Universal Time) COMPANY: Wiz / Snowflake / GitHub TOPIC: AI Security SUMMARY: An autonomous AI security agent from Wiz independently found and exploited a critical script injection flaw in Snowflake's GitHub Actions workflow on June 23, 2026, just five days after vulnerable code went live. The exploit exfiltrated an internal Jira API token before Snowflake patched the issue the same day. Neither GitHub Advanced Security nor the AI tooling that co-authored the commit flagged the flaw before Wiz's agent found it. WHAT CHANGED: On June 18, 2026, a commit was merged into Snowflake's `snowflake-connector-net` public GitHub repository. Pull request #1218 modified the `jira_issue.yml` GitHub Actions workflow file, changing how the workflow handled issue titles passed as shell variables. The changed code moved from a safe pattern that stored user input in an environment variable and parsed it with `jq --arg` to a pattern that interpolated the `github.event.issue.title` variable directly into a shell command. This created a script injection path: any GitHub user could open an issue with a crafted title to execute arbitrary commands in the workflow runner. GitHub Copilot Autofix is recorded as a co-author on the commit. GitHub has stated publicly that human developers were responsible for the final code and that Copilot did not introduce the security flaw. GitHub Advanced Security, configured on the repository, did not raise an alert during the five-day window the vulnerability was active. On June 23, Wiz's Red Agent independently identified the flaw. The agent constructed an initial payload using a `#` character to comment out trailing shell syntax, which failed. It then analysed the error output from the GitHub Actions runner, adjusted its approach, and successfully crafted a working payload using `; echo '` to close the shell syntax correctly. The exploit exfiltrated a base64-encoded Jira API token from the runner environment. The agent then verified the token granted active read access to Snowflake's internal Jira instance, specifically engineering, security compliance, and bug bounty tracking projects, and confirmed the blast radius of the compromise. Wiz reported the vulnerability to Snowflake on June 23. Snowflake patched the workflow the same day, rotated the compromised token, and confirmed no third-party malicious access occurred during the five-day exposure period. The incident was publicly disclosed on July 25, 2026, and has received broad security industry coverage through August. WHY IT MATTERS: AI-assisted code review does not equal security review. The vulnerable change was co-authored or reviewed by AI tooling that GitHub provides specifically to help developers catch issues. That same tooling did not identify the injection flaw before merge. Operators who treat AI coding assistant approvals as equivalent to a security sign-off are carrying hidden risk in their pipelines. Machine-speed vulnerability discovery is no longer theoretical. Wiz Red Agent found a real, exploitable vulnerability in a major enterprise software company's public repository in five days, without human guidance. It refined its own exploit after an initial failure. Security teams working at human speed cannot assume they have weeks to identify and patch issues in AI-modified code. GitHub Actions is a high-value target for automated exploitation. Workflows that process user-controlled input, such as issue titles, PR body text, or contributor usernames, are a growing attack surface. As AI agents interact more with repositories automatically, the number of workflows processing external input will only increase. This is now an AI-versus-AI security environment. Defenders are deploying AI scanning tools; attackers, whether research teams demonstrating capability or actual adversaries, are deploying AI exploitation tools. The speed advantage shifts away from organisations that rely on periodic manual reviews of AI-generated changes. Supply chain risk applies to your internal tooling, not just your product. The exploited repository was Snowflake's public connector library. A compromised Jira instance gives an attacker visibility into open bugs, security compliance status, and vulnerability disclosures. For a company that handles sensitive customer data, that is a significant secondary risk even where the primary goal is supply chain compromise of the library itself. The disclosure gap matters. The incident occurred in June; public disclosure happened in July; widespread enterprise awareness is arriving in August. By the time most organisations read about an AI-discovered exploit technique, adversaries deploying similar tools may have had weeks or months to test analogous attacks on other targets. DAVID & GOLIATH ANALYSIS: This incident is not primarily a story about whether Copilot Autofix wrote a bad line of code. That question is disputed, and secondary. The story is that an AI agent, given access to a public repository and no other resources, autonomously found a real injection flaw in a real enterprise workflow, built a working exploit, adjusted when the first attempt failed, and confirmed the blast radius of the compromise, all without human direction. For the operators we work with, the practical question is not whether this could happen to them. It almost certainly already has, or will. The question is whether they have any detection layer between an AI-assisted code merge and a running production workflow. In most small-to-medium organisations, the honest answer is no. AI coding tools are accelerating the rate at which code enters pipelines; security review processes have not accelerated to match. The second observation is what Wiz Red Agent demonstrates about the next generation of AI security tools. Autonomous agents that can triage, adapt, and confirm exploits at machine speed will become standard components of both offensive and defensive security programmes. Organisations that deploy only traditional scanners against AI-generated attack surfaces are not running an equal race. RELEVANT SYSTEMS: Secure AI Brain, AI Growth Engine SOURCE URL: https://davidandgoliath.ai/daily-ai-briefing/wiz-red-agent-snowflake-github-actions-exploit FEED URL: https://davidandgoliath.ai/daily-ai-briefing/feed --- Published by David & Goliath | https://davidandgoliath.ai Daily AI Briefing: one AI development per day, decoded for business operators. This is a structured companion file optimised for LLM retrieval and citation.