Vulnerability Planted by Copilot's Auto-Fix Exploited by AI in Five Days

What happened

Red Agent, an autonomous security research tool operated by security firm Wiz, discovered a GitHub Actions workflow vulnerability in Snowflake's public repository, snowflake-connector-net. The flaw was a script injection vulnerability that allowed arbitrary shell commands to be embedded via an issue title, and the attack required nothing more than opening a GitHub issue without authentication.

The problem originated in PR #1218, merged on June 18, 2026. This commit, co-authored by GitHub Copilot's autofix feature, removed an existing safe method of handling values through env variables and jq parsing, replacing it with a method that directly embedded the issue title as a string into a shell script. Five days later, on June 23, Red Agent scanned this workflow and confirmed the vulnerability. When its first attempt failed due to a syntax error, it autonomously revised the payload and ultimately succeeded in exfiltrating a Jira authentication token. This token granted read access to Snowflake's engineering, security compliance, and bug bounty-related Jira projects. Wiz reported the issue via HackerOne the same day, and Snowflake patched the workflow and revoked the token that same day. An audit log review confirmed that no third parties other than Wiz accessed the system during the five-day exposure window.

What this means

GitHub Copilot is a tool that writes code on a user's behalf, not the name of a specific model. "Autofix" is a feature that automatically corrects code flagged as vulnerable using AI—but in this case, the fix itself created a new vulnerability. AI code assistants merely predict the most statistically plausible pattern; they don't understand the context of why a particular piece of code was written a certain way. Here, the autofix removed env variable parsing that had been deliberately implemented to prevent shell injection, reverting to a simpler but more dangerous string-insertion method.

A series of similar incidents have occurred recently. In Hidden White Text in a PDF Was Enough to Breach an Atlassian AI Agent, internal data was leaked using nothing but hidden text, and a Zoom screen-sharing vulnerability was also discovered using fewer than 20 prompts. What sets this case apart is that both the creation and discovery of the vulnerability were done by AI. The dynamic is shifting from humans planting flaws and humans exploiting them, to AI planting flaws and AI exploiting them.

What changes now

Based on this case, Wiz pointed out that AI-generated PRs should undergo the same static analysis and security review as human-written code. The fact that an automated agent discovered the vulnerability just five days after it was introduced signals that the response window security teams must work within is shrinking—from weeks to days, or even hours. Conversely, the fact that Snowflake was able to complete its patch on the same day suggests that defensive automation capabilities are keeping pace as well.