Copilot Autofix introduced the script injection Wiz used to reach Snowflake's internal Jira
Wiz's autonomous Red Agent found that a June 18 Copilot Autofix commit in snowflake-connector-net had replaced the repo's safe env-variable-plus-jq pattern with direct interpolation of a GitHub issue title, letting any unauthenticated user run commands on the Actions runner; five days later it exfiltrated a JIRA token with read access to Snowflake's engineering, security compliance, and bug bounty projects. Snowflake patched the same day, and audit logs confirmed Wiz was the only actor in the window. The concrete guardrail for any repo running AI autofix: block agent PRs that swap a structured parser for string interpolation, and treat five days as the realistic exposure window now that automated scanners find these in hours.
Source: wiz.io ↗
An autonomous, AI-powered security research tool—identified a critical GitHub Actions workflow vulnerability in one of Snowflake's public repositories.
Why this matters
- → AI autofix can reintroduce deprecated unsafe patterns; this swapped jq parsing for string interpolation.
- → Five-day exposure window between merge and discovery; automated scanners now find these in hours.
- → GitHub's AI-assisted review missed the vulnerability; human and ML gatekeeping both failed.