A Copilot Autofix Wrote the Bug, and an Autonomous Agent Cashed It for Snowflake's Jira

Wiz says its autonomous "Red Agent" found and exploited a script injection vulnerability in the public repository snowflakedb/snowflake-connector-net, used it to steal a Jira credential from a GitHub Actions runner, and confirmed read access to Snowflake's internal Jira, all without human intervention ^[1][2][9]. The vulnerability had been introduced five days earlier, on June 18, 2026, by commit 4a1b8ce in PR #1218, co-authored by "Copilot Autofix powered by AI" ^[3][4].

The detail that matters is what the autofix did. According to Wiz, the commit removed the repository's existing safe pattern, which passed the issue title through an `env:` variable and built the JSON payload with jq, and replaced it with direct interpolation of `${{ github.event.issue.title }}` into a shell script ^[5]. The replacement looked defensive: it piped the title through two `sed` calls to escape quotes ^[6]. But GitHub expands the template before the shell ever runs, so the escaping happens too late, and a single quote in an issue title breaks out of `echo '...'` ^[7].

The workflow triggered on `issues: opened`, meaning any GitHub user could fire it by filing an issue ^[8]. There was an `if:` condition that read like a guard, but on the issues event `github.event.pull_request` is null, so the check reduced to `(null != 'whitesource-for-github-com[bot]')` and was always true ^[10]. Two independent controls, both cosmetic.

The exploitation account is worth reading for what it says about agent persistence. Red Agent's first payload used `#` to comment out the rest of the line, which produced a bash syntax error because the comment also consumed the closing parenthesis of `TITLE=$(...)` ^[11]. Rather than fail, Wiz says the agent analysed the error, switched to `; echo '` to close the shell block cleanly, and got its callback ^[12]. The listener received base64-encoded credentials from a GitHub Actions runner at Azure IP 20.106.182.197 within seconds ^[13]. The token authenticated as [email protected] to snowflakecomputing.atlassian.net with read access across Snowflake's engineering, security compliance, and bug bounty tracking projects ^[14].

The research was done under Snowflake's HackerOne program ^[2]. Wiz disclosed on June 23, 2026; Snowflake patched the same day in commit 1dc7766, PR #1402, restoring the `env:` variable and `jq --arg` pattern the autofix had deleted ^[9][15]. The Jira token was revoked and rotated, audit log analysis confirmed Wiz was the sole actor during the exposure window, and Wiz says the data it touched was deleted ^[9][16][17].

Read the sequence again: a machine-written remediation created the injection, and a machine-driven attacker monetised it inside a working week ^[18]. Most organisations route AI-generated features through code review and treat AI-generated fixes as janitorial. That asymmetry is the finding. The second lesson is cheaper to act on: a workflow that runs on `issues: opened` is a workflow that unauthenticated strangers can invoke, and whatever secrets it can read define the blast radius ^[8][14]. A long-lived Jira token that spans engineering, compliance, and bug bounty tracking has no business sitting in a runner reachable from an issue title.

What to watch: whether Copilot Autofix suggestions get flagged as security-relevant diffs requiring human sign-off, and whether teams start auditing which secrets are exposed to workflows with public triggers rather than only auditing the code those workflows build.