Wiz agent finds Snowflake repo flaw in code co-authored by GitHub Copilot Autofix

Wiz’s AI-powered “Red Agent” autonomously discovered a flaw in a Snowflake GitHub repo that arose from a recent commit co-authored by GitHub's Copilot Autofix, Wiz disclosed Monday.  

The flaw in the snowflakedb/snowflake-connector-net repository was found by the agent during research conducted by Wiz through Snowflake’s HackerOne vulnerability disclosure program. The vulnerability existed in a GitHub Actions workflow that allowed a Jira ticket to be created whenever an issue was opened on the repo.

A change made on June 18, 2026, that was co-authored by “Copilot Autofix powered by AI” inadvertently introduced a script injection vulnerability that could be triggered by a crafted issue title.

Copilot Autofix was first introduced in August 2024 as an AI tool on GitHub that analyzes, explains and offers suggested code fixes for vulnerabilities detected in code scans.

When a scan alert is assigned to Copilot, Copilot Autofix “explores your codebase, generates a fix, validates it, and opens a pull request,” according to GitHub documentation.

The autofix feature interfaces with OpenAI’s GPT-5.3-Codex to generate suggested fixes and explanations, GitHub said.

In this case, Wiz found that the commit co-authored by Copilot Autofix in a workflow called jira_issue.yml removed an existing safe pattern that stored issue titles as an environment variable before building a JSON payload with jq.

The new pattern directly interpolated the issue title into the shell script within an echo command and added sed escaping for sanitization before constructing the JSON with jq.

However, because this sanitization occurred after GitHub’s template expansion, an issue title could be crafted to break out of the quoted string passed to echo using a single quote character (') before any sanitization was applied.

An attacker could therefore inject arbitrary Bash commands through a crafted issue title, which were automatically run by the GitHub Actions workflow when the issue was submitted.

Wiz’s Red Agent attempted to test this exploit, initially failing by using a comment character (#) that consumed the closing parenthetical of the command substitution construct TITLE=$(…). The agent then analyzed the syntax error returned by the runner, adjusted the payload and successfully injected a command that extracted the base64-encoded Jira token from the runner.

Wiz verified that the token granted read access to an internal Snowflake Jira environment that included projects related to engineering, security compliance and bug bounty tracking.

Wiz discovered and reported the bug on June 23, 2026, and the issue was patched by Snowflake the same day, restoring the original safe pattern. Snowflake also rotated the affected Jira token and confirmed that it was not accessed by any third parties other than Wiz during the five-day period that the vulnerability was present.

“Protecting our systems remains a top priority, and we remain committed to continually strengthening our software development and security practices. We are working together with Wiz to share these learnings with the broader industry to encourage widespread adoption of these security best practices,” Snowflake said in a public statement.

Wiz concluded that AI-generated code, including pull requests generated by tools such as Copilot Autofix, require “the same static analysis and security scrutiny as human code.”

The researchers noted that guardrails should be implemented to prevent AI coding agents replacing safe code patterns with risky ones, such as direct string interpolation, as “automated AI assistants often lack historical context regarding why specific code patterns were chosen.”

Previous research has highlighted vulnerabilities that can arise from AI-generated code, with GitGuardian reporting earlier this year that commits co-authored by Claude Code leaked secrets at about twice the baseline rate.

Wiz also highlighted the short gap between the introduction of the flaw and its discovery by another AI agent, saying that the rise of automated vulnerability discovery necessitates faster patching and the use of short-lived credentials to minimize the impact of exposure.