이미지: Hacker News (200↑)
Summary
- Wiz's autonomous security agent "Red Agent" discovered a script injection vulnerability in a public Snowflake repository
- The flaw was found just five days after being introduced by a commit co-authored by GitHub Copilot's autofix feature, and Snowflake patched it the same day it was reported
- The stolen token was confirmed to grant read access to Jira projects related to engineering, security compliance, and bug bounty programs
- 취약점 도입일
- 2026년 6월 18일, PR #1218 (Copilot Autofix 공동 작성)
- 발견·신고
- 2026년 6월 23일, Wiz Research가 HackerOne으로 스노우플레이크에 신고
- 패치
- 같은 날 PR #1402로 env: + jq --arg 방식 복원
- 탈취 권한 범위
- qa@snowflake.net 계정으로 엔지니어링·보안 컴플라이언스·버그바운티 지라 프로젝트 읽기 접근
- 노출 기간
- 5일, 감사 로그상 제3자 접근 없음 확인
What happened
Red Agent, an autonomous security research tool operated by security firm Wiz, discovered a GitHub Actions workflow vulnerability in Snowflake's public repository, snowflake-connector-net. The flaw was a script injection vulnerability that allowed arbitrary shell commands to be embedded via an issue title, and the attack required nothing more than opening a GitHub issue without authentication.
The problem originated in PR #1218, merged on June 18, 2026. This commit, co-authored by GitHub Copilot's autofix feature, removed an existing safe method of handling values through env variables and jq parsing, replacing it with a method that directly embedded the issue title as a string into a shell script. Five days later, on June 23, Red Agent scanned this workflow and confirmed the vulnerability. When its first attempt failed due to a syntax error, it autonomously revised the payload and ultimately succeeded in exfiltrating a Jira authentication token. This token granted read access to Snowflake's engineering, security compliance, and bug bounty-related Jira projects. Wiz reported the issue via HackerOne the same day, and Snowflake patched the workflow and revoked the token that same day. An audit log review confirmed that no third parties other than Wiz accessed the system during the five-day exposure window.
What this means
GitHub Copilot is a tool that writes code on a user's behalf, not the name of a specific model. "Autofix" is a feature that automatically corrects code flagged as vulnerable using AI—but in this case, the fix itself created a new vulnerability. AI code assistants merely predict the most statistically plausible pattern; they don't understand the context of why a particular piece of code was written a certain way. Here, the autofix removed env variable parsing that had been deliberately implemented to prevent shell injection, reverting to a simpler but more dangerous string-insertion method.
A series of similar incidents have occurred recently. In Hidden White Text in a PDF Was Enough to Breach an Atlassian AI Agent, internal data was leaked using nothing but hidden text, and a Zoom screen-sharing vulnerability was also discovered using fewer than 20 prompts. What sets this case apart is that both the creation and discovery of the vulnerability were done by AI. The dynamic is shifting from humans planting flaws and humans exploiting them, to AI planting flaws and AI exploiting them.
What changes now
Based on this case, Wiz pointed out that AI-generated PRs should undergo the same static analysis and security review as human-written code. The fact that an automated agent discovered the vulnerability just five days after it was introduced signals that the response window security teams must work within is shrinking—from weeks to days, or even hours. Conversely, the fact that Snowflake was able to complete its patch on the same day suggests that defensive automation capabilities are keeping pace as well.
