Wiz's Red Agent breaks into Snowflake's Jira in five days, then blames the wrong AI

An autonomous agent found and exploited a live GitHub Actions injection in a Snowflake repo. The Copilot Autofix attribution collapsed within eight hours.

Wiz Research’s autonomous Red Agent needed five days to find and exploit a GitHub Actions injection in Snowflake’s public snowflake-connector-net repo, exfiltrate a live Jira token, and read across the company’s engineering, security compliance, and bug bounty projects. The attribution Wiz built around that finding lasted about eight hours.

The bug itself is the kind CI/CD engineers have been warned about for years. Snowflake’s jira_issue.yml fired whenever a public GitHub issue opened, then interpolated the issue title straight into a shell echo block. A permission check meant to gate the workflow referenced github.event.pull_request.user.login on an issue event, a property that doesn’t exist there, so any GitHub user could reach the sink. Red Agent’s first payload failed on a syntax error. It read the error, revised, and succeeded on the second try. The qa@snowflake.net Jira token went out base64-encoded to an out-of-band listener.

Snowflake got the HackerOne report (#3819931) on June 23, 2026, patched the same day via PR #1402, and rotated the token on June 24. Audit logs matched every anomalous query to Wiz’s testing IPs. “Our investigation found no evidence of unauthorized access,” Snowflake said in a statement Wiz reproduced.

Then came the framing that unraveled. Wiz’s original post pinned the vulnerable code on a commit co-authored by “Copilot Autofix powered by AI.” The Hacker News walked the git history and found the Copilot commit touched jira_close.yml, a different file. The unsafe jira_issue.yml refactor lived in commit 094038e from August 25, 2025, written by a Snowflake engineer; a squash merge (4a1b8ce) dragged the Copilot trailer along for the ride. GitHub told The Next Web that Copilot Autofix “neither reviewed nor contributed” to the vulnerable code. At 19:57 UTC on August 17, Wiz updated its post to concede “it’s unclear whether the code-change was AI-assisted.”

The Register appended a correction. Its editor Jessica Lyons wrote the outlet “won’t be trusting Wiz for a very long time.”

What survives the retraction is the boring finding. GitHub published guidance against this exact injection pattern in July 2025. The commit that introduced it landed one month later, from a human engineer, in a repo belonging to a company whose 2024 was defined by credential incidents. An autonomous agent found it in five days. The AI story here was never Copilot.