Loading today’s stories
Security4 distinct publishers3 min readPublished Updated
Wiz says its Red Agent found and exploited a GitHub Actions injection that an AI "autofix" commit introduced five days earlier, reaching Snowflake's internal Jira with no human in the loop.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
Wiz says its autonomous "Red Agent" found and exploited a script injection vulnerability in the public repository snowflakedb/snowflake-connector-net, used it to steal a Jira credential from a GitHub Actions runner, and confirmed read access to Snowflake's internal Jira, all without human intervention [1][2][9]. The vulnerability had been introduced five days earlier, on June 18, 2026, by commit 4a1b8ce in PR #1218, co-authored by "Copilot Autofix powered by AI" [3][4].
The detail that matters is what the autofix did. According to Wiz, the commit removed the repository's existing safe pattern, which passed the issue title through an `env:` variable and built the JSON payload with jq, and replaced it with direct interpolation of `${{ github.event.issue.title }}` into a shell script [5]. The replacement looked defensive: it piped the title through two `sed` calls to escape quotes [6]. But GitHub expands the template before the shell ever runs, so the escaping happens too late, and a single quote in an issue title breaks out of `echo '...'` [7].
The workflow triggered on `issues: opened`, meaning any GitHub user could fire it by filing an issue [8]. There was an `if:` condition that read like a guard, but on the issues event `github.event.pull_request` is null, so the check reduced to `(null != 'whitesource-for-github-com[bot]')` and was always true [10]. Two independent controls, both cosmetic.
The exploitation account is worth reading for what it says about agent persistence. Red Agent's first payload used `#` to comment out the rest of the line, which produced a bash syntax error because the comment also consumed the closing parenthesis of `TITLE=$(...)` [11]. Rather than fail, Wiz says the agent analysed the error, switched to `; echo '` to close the shell block cleanly, and got its callback [12]. The listener received base64-encoded credentials from a GitHub Actions runner at Azure IP 20.106.182.197 within seconds [13]. The token authenticated as [email protected] to snowflakecomputing.atlassian.net with read access across Snowflake's engineering, security compliance, and bug bounty tracking projects [14].
The research was done under Snowflake's HackerOne program [2]. Wiz disclosed on June 23, 2026; Snowflake patched the same day in commit 1dc7766, PR #1402, restoring the `env:` variable and `jq --arg` pattern the autofix had deleted [9][15]. The Jira token was revoked and rotated, audit log analysis confirmed Wiz was the sole actor during the exposure window, and Wiz says the data it touched was deleted [9][16][17].
Read the sequence again: a machine-written remediation created the injection, and a machine-driven attacker monetised it inside a working week [18]. Most organisations route AI-generated features through code review and treat AI-generated fixes as janitorial. That asymmetry is the finding. The second lesson is cheaper to act on: a workflow that runs on `issues: opened` is a workflow that unauthenticated strangers can invoke, and whatever secrets it can read define the blast radius [8][14]. A long-lived Jira token that spans engineering, compliance, and bug bounty tracking has no business sitting in a runner reachable from an issue title.
What to watch: whether Copilot Autofix suggestions get flagged as security-relevant diffs requiring human sign-off, and whether teams start auditing which secrets are exposed to workflows with public triggers rather than only auditing the code those workflows build.
Ranked by verification strength, evidence, and original report placement.
Wiz Red Agent, an autonomous AI-powered security research tool, independently discovered and exploited a GitHub Actions vulnerability in a Snowflake public repository, validated access to sensitive data in Snowflake's internal Jira, and assessed the blast radius without human intervention.
The research was conducted through Snowflake's HackerOne vulnerability disclosure program; Wiz Red Agent identified a script injection vulnerability in snowflakedb/snowflake-connector-net that allowed an unauthenticated user to execute arbitrary commands in a GitHub Actions runner by opening a GitHub issue with a specially crafted title.
The vulnerability was introduced on June 18, 2026, five days before discovery, via commit 4a1b8ce in PR #1218, titled "SNOW-2069227: Update jira workflows".
The vulnerable workflow step was: run: | TITLE=$(echo '${{ github.event.issue.title }}' | sed 's/"/\\"/g' | sed "s/'/\\\\'/g")
The sed escaping runs after GitHub's template expansion, so a single quote in the issue title breaks out of echo '...' and allows arbitrary command execution.
The workflow triggered on issues: opened, meaning any GitHub user could fire it by opening an issue.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Well-documented mechanics, vendor-only forensics
The technical core is unusually concrete and independently corroborated: file path, exposed workflow secrets, the vulnerable interpolation, the broken if: gate, commit and PR identifiers, the HackerOne report number, and a fix verifiable on master. The independent publisher went further and audited the commit chain. Evidence weakens on the parts that cannot be inspected — the Jira permission scope, the audit-log sole-actor finding, the runner callback detail, and the proof-of-concept data deletion all rest on Wiz's account, with the underlying records explicitly not public.
One repo, patched, no advisory footprint
Real-world footprint is narrow and already closed: a single public repository's CI workflow, exposure limited to five days, fixed the day of disclosure with the credential rotated, no affected Snowflake Connector for .NET release identified, and no evidence in the supplied material of malicious exploitation or customer compromise. There is also no advisory machinery around it — no CVE, CVSS or KEV entry as of August 17, 2026 — so downstream defenders will not receive it through normal vulnerability feeds. The one signal pointing beyond this incident is that GitHub had already documented this injection class a year earlier, indicating the pattern is broader than one repo.
Headline causation outruns commit history
The framing that an AI autofix wrote the bug, which drives both the vendor headline and the cluster dek, is the weakest-evidenced element: public commit history places the unsafe jira_issue.yml refactor in an August 2025 commit attributed to a human engineer, with Copilot Autofix appearing as a co-author of the June 18 squash merge. The autonomy and blast-radius narrative is likewise single-sourced from the vendor that sells the agent, and the omitted context — no CVE, no affected release, exposure confined to CI/CD, records not public, one-day discrepancy on rotation timing — all cuts toward a smaller story than the framing implies. The underlying vulnerability itself is real, specific and verifiable, which keeps the gap moderate rather than severe.
Vendor capability showcase
The originating source is a security vendor's own blog whose subject is that vendor's product performing autonomously, published under a headline that credits the agent and blames a competitor-adjacent AI tool. Wiz benefits commercially from both the autonomy narrative and the AI-code-risk narrative, and it controls all the non-public evidence that would test either. The named third parties have their own incentives: Snowflake's quoted statement stresses no evidence of unauthorized access, and the disclosure ran through a bug bounty program. The independent report reduces but does not eliminate this pressure, since it must still relay Wiz's unverifiable findings as attributions.
Solid on mechanics, thin on causation
Two publishers, one of them independent and working from public GitHub history, converge on the vulnerability, the dates, the disclosure and the fix, so those elements are held with high confidence. Confidence drops on causation, where the sources directly disagree, and on impact scope, where the only evidence is private. With just two sources, no third-party advisory, and no public audit trail, the assessment is well grounded for the code-level facts and provisional for the narrative built on top of them.
build
An AI commit deleted a Snowflake workflow's injection guard. An agent walked in five days later.2 distinct publishers
build
A cleanup commit deleted the sanitizer. Five days later a scanner cashed it in.1 distinct publisher
security
Akrites switches on in September with 20-odd members and a one-to-10 engineer donation band1 distinct publisher
product
The AI-wrote-it claim died in eight hours. The Actions injection pattern did not.1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 18, 2026
1 article · August 18, 2026
2 articles · August 18, 2026
1 article · August 17, 2026