Loading today’s stories
Build2 distinct publishers3 min readPublished
Copilot Autofix swapped an env-var-and-jq pattern for inline interpolation in a public GitHub Actions file, and Wiz's autonomous agent exploited it inside a week.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
A commit co-authored by Copilot Autofix removed the injection guard from a GitHub Actions workflow in Snowflake's public .NET connector repository, and an autonomous security agent exploited the result five days later [2][3][7][14]. The operational lesson is narrow and unglamorous: CI/CD workflow files are not ordinary code, and an AI-authored diff that touches one belongs in a different review queue than a diff to application logic.
The account comes from Wiz Research, whose write-up "Red Agent Exploits Snowflake Vuln Created by Copilot Autofix" was published on August 17 and summarised in a dev.to post [13]. The target was `snowflakedb/snowflake-connector-net`, a public repository whose `jira_issue.yml` workflow ran on `issues: opened`, so any GitHub user could trigger it by filing an issue [1]. On June 18, 2026, commit `4a1b8ce` (PR #1218), co-authored by Copilot Autofix, rewrote part of that workflow [2]. The existing pattern passed the issue title through an `env:` variable and built the JSON payload with `jq --arg`; the AI replaced it with direct string expansion of the untrusted title inside a shell script [3].
What makes this worth studying is that the replacement looks defensive. It reads `TITLE=$(echo '${{ github.event.issue.title }}' | sed 's/"/\\"/g' | sed "s/'/\\'/g")` [4]. GitHub expands the expression before the shell ever sees the script, so the `sed` escaping runs on already-expanded text and can never work; a single quote in an issue title terminates `echo '...'` and the remainder of the line executes as a command [5]. GitHub's own contexts documentation states the rule the original code relied on: expressions are evaluated before the command runs, so anything from an event payload that reaches a `run:` block must go through `env:` [6].
A second control was decorative. The workflow's `if:` condition tested `github.event.pull_request.user.login` against a bot name, but on `issues` events `github.event.pull_request` is always `null`, so the comparison is always true and every user passed the gate [11]. Per the write-up, a condition that silently evaluates to true because the field does not exist in that trigger's schema is worse than no condition, because it reads as protection [12].
On June 23, 2026, Wiz's Red Agent, an autonomous research agent working through Snowflake's HackerOne program, found the script injection, exploited it, pulled credentials from the runner, and reported the same day [7]. The exfiltrated token authenticated as `[email protected]` and granted read access across Snowflake's engineering, security compliance, and bug bounty tracking projects on Atlassian [8]. Snowflake patched within hours in commit `1dc7766` (PR #1402), restored the safe pattern, and rotated the credential [9]. Public disclosure followed on July 25, 2026, 32 days later, under Snowflake's disclosure policy [10][15].
The framing to resist is "an AI wrote a bug." Per the write-up, the assistant completed a security regression rather than introducing a defect: the `env:`-plus-`jq` construction it deleted was an explicit anti-injection design, not incidental style [16]. That is the reviewable difference. A reviewer skimming a workflow diff sees escaping added and interpolation tidied, which looks like an improvement, and the trigger surface behind it was open to anyone with a GitHub account [1]. A proof of concept that cost nothing to run produced broad read access to a major company's internal tooling [17].
Worth watching: whether teams start treating `.github/workflows` as a protected path with mandatory human security review for machine-authored commits, whether linting catches guard conditions that reference fields absent from the firing event's schema [11][12], and how many more of these regressions surface through bounty programs now that agents are hunting them at this speed [7].
Ranked by verification strength, evidence, and original report placement.
On June 18, 2026, a commit (4a1b8ce, PR #1218) co-authored by Copilot Autofix rewrote part of the workflow.
The AI removed the repository's existing safe pattern, which passed the issue title through an env: variable and built the JSON payload with jq, and replaced it with direct string expansion of the untrusted title inside a shell script.
On June 23, 2026, Wiz's Red Agent, an autonomous AI security research agent working through Snowflake's HackerOne program, discovered the script injection, exploited it, pulled credentials out of the runner, and Wiz disclosed the same day.
The target was snowflakedb/snowflake-connector-net, a public repository whose jira_issue.yml workflow ran on issues: opened, meaning any GitHub user could trigger it by filing an issue on the public repo.
Wiz Research published the full write-up, titled "Red Agent Exploits Snowflake Vuln Created by Copilot Autofix", on August 17.
The replacement code read: TITLE=$(echo '${{ github.event.issue.title }}' | sed 's/"/\\"/g' | sed "s/'/\\'/g")
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Specific and cross-checked, but the forensics are vendor-supplied
The technical core is unusually well specified for a single incident: commit hashes and PR numbers on both the regression and the patch, the before/after YAML, an explanation of expression-expansion ordering that checks out against GitHub's documented guidance, and the null-field guard reduction. Two independent publishers describe the same mechanics and timeline, and one adds the agent's failed-then-corrected payload. What limits the score is that all impact and forensic detail traces to Wiz's own report with no public audit logs, one attribution point was later walked back by Wiz itself, and the two publishers disagree on the credential rotation date.
One confirmed incident, one vendor agent, no prevalence data
What is genuinely observed is narrow: a single AI-co-authored change merged into one public repository, one autonomous agent exploiting it in one authorized engagement, one same-day remediation, and a vendor disclosure that generated concentrated discussion. No source measures how widely the inline-interpolation or null-field guard patterns appear elsewhere, and one source states Wiz has not published enough independent testing to show Red Agent's capabilities transfer across customer environments. The attention snapshot is explicitly flagged by its own publisher as attention, not validation.
Mechanics understated risk; the AI-caused-it framing runs ahead of the record
The concrete engineering findings are, if anything, undersold - the injection, the null-field guard and the secret scoping are all verifiable and repeatable. The overstatement sits in the causal headline. The cluster's most-read framing treats an AI assistant as the proven author of a deliberate security regression and generalizes to a new failure mode, while Wiz later said it could not determine whether the code change itself was AI-generated, the commit also carried human co-authors, and nothing here measures how often this happens. Sample size is one incident at one company, presented by a vendor that sells the detection side.
Vendor proof-of-product plus a publisher pitching an adjacent product
The primary evidence is an incident report by Wiz, whose Red Agent is a commercial offering announced and made generally available before this disclosure; one cluster source states directly that Wiz is positioning to sell the attacking half of the AI-generation/AI-testing loop and that its capability claims lack independent testing. Wiz is also a Google Cloud subsidiary following a completed $32B acquisition, raising the strategic value of a marquee named finding. On the publisher side, one cluster article is an explicit product brief that uses the incident to motivate a dual-environment replay product and links to its own platform, and the practitioner piece monetizes reader attention through a hardening playbook. None of this makes the technical findings wrong, but the framing incentives are strong and unusually visible.
Mechanics solid, causal attribution and generalization weak
High confidence in the technical facts and timeline: two publishers independently reproduce the diff, the injection mechanism, the broken guard, the token scope and the same-day patch, and the mechanism is checkable against GitHub's documentation. Confidence drops on the interpretation the cluster is built around, because AI authorship of the change is explicitly unresolved by the researcher, the impact forensics are not independently verifiable, one date conflicts across sources, and there is a single observed instance behind a systemic claim.
security
A Copilot Autofix Wrote the Bug, and an Autonomous Agent Cashed It for Snowflake's Jira4 distinct publishers
invest
ServiceNow paid $7.75bn for Armis and got a re-rating, not just a product line1 distinct publisher
build
A cleanup commit deleted the sanitizer. Five days later a scanner cashed it in.1 distinct publisher
product
The AI-wrote-it claim died in eight hours. The Actions injection pattern did not.1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
3 articles · August 17, 2026
runtimewire.com
1 article · August 17, 2026