What changed in the Snowflake repository
Wiz Research's Red Agent, an autonomous AI-powered security research tool, identified a critical script injection vulnerability in the snowflakedb/snowflake-connector-net GitHub Actions workflow on June 23, 2026, during testing carried out through Snowflake's HackerOne vulnerability disclosure program. The issue allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner simply by opening a GitHub issue whose title contained a single quote. According to Wiz Research, the vulnerability became live on June 18, 2026, five days before discovery, when PR #1218, titled "SNOW-2069227: Update jira workflows," was squash-merged on GitHub.
The flaw GitHub's tools did not catch
The merged change to jira-issue.yml removed an existing safe pattern using `env:` and `jq` and replaced it with direct interpolation of `${{ github.event.issue.title }}` inside a `run:` block, with `sed` escaping that runs only after GitHub's template expansion. GitHub Advanced Security, which uses GitHub Copilot Autofix, analyzed the final PR revision, including the vulnerable workflow, but did not flag the injection. Gal Nagli, head of threat exposure at Wiz Research, documented the gap in a report published on August 17, 2026. Copilot Autofix's documented contribution to the same PR was a separate fix to jira-close.yml; Wiz notes that whether the underlying code change itself was AI-assisted remains unclear.
How the Red Agent exploited it
Once discovered, Wiz's Red Agent independently exploited the injection, validated access to sensitive data in Snowflake's internal Jira connector using an exfiltrated token, and assessed the blast radius, all without human intervention. The exploit chain was triggered by any GitHub user opening an issue, after which the single-quote escape in the title allowed arbitrary command execution inside the Actions runner.
Snowflake's remediation
Snowflake patched the vulnerable script-injection workflow on June 23, 2026, via commit 1dc7766 (PR #1402), the same day Wiz disclosed the issue through HackerOne, and rotated the affected Jira token on June 24. "The disclosure was immediately investigated and remediated, and our investigation found no evidence of unauthorized access," Snowflake said in a public disclosure. Wiz confirmed via detailed audit logs that it was the sole actor during the exposure window and said all data accessed during proof-of-concept testing was securely deleted.
What the episode signals
The disclosure frames a broader point about AI-assisted development and AI-driven defense: critical vulnerabilities can still be introduced and approved within workflows that involve AI coding agents and can still pass established automated security checks, while autonomous AI security agents can discover and exploit such flaws rapidly. Wiz Research is sharing the case with the industry alongside Snowflake to encourage broader adoption of the security best practices surfaced by the incident.
Share this article
