An AI Agent Found and Exploited a 5-Day-Old GitHub Actions Flaw That Another AI Co-Authored and Approved

TL;DR: Wiz's Red Agent autonomously found and exploited a script injection in Snowflake's CI workflow five days after GitHub Copilot co-authored the vulnerable PR and reviewed it as clear — a useful case study for teams running AI-assisted CI.

On June 18, 2026, a pull request to snowflakedb/snowflake-connector-net replaced a safe pattern (env vars + jq parsing) with direct shell interpolation of a GitHub issue title. GitHub Copilot was listed as co-author. The PR merged.

Five days later, Wiz's Red Agent autonomously reviewed the workflow, crafted a payload, got the first attempt wrong, read the Bash error output, revised the payload, and exfiltrated Jira credentials to an attacker-controlled server — no human guidance. Snowflake patched the same day after responsible disclosure.

What to check in your workflows. The unsafe pattern is ${{ github.event.issue.title }} or any user-controlled string interpolated directly into a run: shell step. The fix is to route it through an environment variable instead: env: ISSUE_TITLE: ${{ github.event.issue.title }} and reference $ISSUE_TITLE in the shell. GitHub's own security hardening guide documents exactly this pattern.

A note on the source. This is primarily Wiz's own disclosure — their Red Agent is a security product, and the blog post serves their interests. Independent coverage from The Hacker News and CyberSecurity News corroborates the technical details and Snowflake's confirmation.

Why it matters: AI code review doesn't transfer security responsibility — a model that approved the PR was also a model that could exploit it. For teams using Copilot or Claude Code to review CI changes, own the security check on untrusted-input workflows.

Sources: Red Agent Exploits Snowflake Vuln Missed by GitHub Copilot — Wiz · Snowflake GitHub Actions Flaw — The Hacker News · GitHub Actions Security Hardening — GitHub Docs