An autonomous AI security tool discovered and exploited a critical vulnerability in Snowflake's public GitHub repository that human reviewers and GitHub's security systems missed, highlighting new risks in AI-assisted software development.

Wiz Research's "Red Agent" identified a GitHub Actions workflow injection vulnerability in snowflakedb/snowflake-connector-net that allowed unauthenticated users to execute arbitrary commands by crafting malicious issue titles. The flaw became live on June 18, 2026, when PR #1218 was merged — just five days before Red Agent found and exploited it.

The vulnerability emerged when developers replaced a safe environment variable pattern with direct string interpolation in the jira_issue.yml workflow. GitHub Copilot had co-authored the pull request and marked it as secure, while GitHub Advanced Security scanned the final revision but failed to flag the injection risk.

Autonomous Exploitation in Real Time

Red Agent's initial exploitation attempt using a standard comment character failed due to bash syntax errors. The AI system then autonomously analyzed the error, adjusted its payload to properly close the shell block, and successfully exfiltrated Jira credentials via an out-of-band callback.

The stolen token authenticated as [email protected] to snowflakecomputing.atlassian.net, granting read access across Snowflake's engineering, security compliance, and bug bounty tracking projects. GitHub Actions runners from Azure IP addresses transmitted the base64-encoded credentials to Red Agent's listener within seconds.

Snowflake patched the workflow on the same day Wiz reported the vulnerability through its HackerOne program. The company rotated the affected credentials and conducted forensic analysis confirming no other parties accessed the endpoint during the five-day exposure window.

The incident demonstrates how AI coding tools can reintroduce insecure patterns based on probabilistic training data. The merged pull request removed Snowflake's existing safe parsing pattern using environment variables and jq, replacing it with vulnerable direct interpolation that existing security tools failed to catch.

"The vulnerability was live for only five days before an automated agent discovered and validated it," Wiz researchers noted. "Security operations must adapt to a landscape where automated discovery occurs in hours, requiring rapid patch cycles and short-lived credentials."

The case underscores the need for rigorous security oversight of AI-generated code, as automated tools can inadvertently revert to deprecated or insecure coding patterns while passing traditional security reviews.