Full Report
Wiz Red Agent independently discovered and exploited a GitHub Actions vulnerability introduced by GitHub Copilot Autofix, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius—all without human intervention.
Analysis Summary
# Incident Report: AI-Generated GitHub Actions Injection in Snowflake Repository
## Executive Summary
Wiz Red Agent, an autonomous AI security research tool, discovered and exploited a critical command injection vulnerability in a Snowflake public GitHub repository. The vulnerability was inadvertently introduced by "GitHub Copilot Autofix," which replaced secure code with an insecure string interpolation pattern. The exploit allowed unauthorized access to sensitive Snowflake internal Jira credentials and data before being remediated.
## Incident Details
- **Discovery Date:** June 23, 2026
- **Incident Date:** June 18, 2026 (Vulnerability introduction)
- **Affected Organization:** Snowflake
- **Sector:** Data Cloud / Software
- **Geography:** Global / Cloud-based
## Timeline of Events
### Initial Access
- **Date/Time:** June 18, 2026 (Injection introduction); June 23, 2026 (Discovery/Exploitation)
- **Vector:** GitHub Actions Workflow Injection
- **Details:** GitHub Copilot Autofix submitted PR #1218, replacing a safe `env` variable pattern with a direct `${{ github.event.issue.title }}` interpolation in a shell script.
### Lateral Movement
- **Mechanism:** Using the exfiltrated `JIRA_TOKEN` and `JIRA_USER` secrets from the GitHub Actions runner environment to authenticate against Snowflake's internal Jira instance.
### Data Exfiltration/Impact
- **Impact:** Red Agent validated access to sensitive internal Jira issues and project metadata.
- **Scope:** Access was limited to the permissions associated with the compromised Jira service account.
### Detection & Response
- **Discovery:** Identified by Wiz Red Agent during an autonomous scan of Snowflake’s GitHub organization.
- **Response Actions:** Wiz disclosed the finding via HackerOne on June 23. Snowflake remediated the workflow, rotated credentials, and conducted an audit within 24 hours.
## Attack Methodology
- **Initial Access:** Command injection via a malicious GitHub Issue title.
- **Persistence:** None (ephemeral runner), but potential via long-lived Jira tokens.
- **Privilege Escalation:** Exploiting a misconfigured `if:` condition that failed to block untrusted users.
- **Defense Evasion:** Red Agent autonomously adjusted its payload (from `#` to `; echo '`) to bypass bash syntax errors.
- **Credential Access:** Extraction of `JIRA_TOKEN` from GitHub Secrets during workflow execution.
- **Discovery:** Scanning of public CI/CD configuration files (`.yml`).
- **Lateral Movement:** Using stolen API tokens to access internal Jira systems.
- **Collection:** Querying Jira API for internal tickets.
- **Exfiltration:** Out-of-band (OOB) callback to a Red Agent-controlled listener.
- **Impact:** Unauthorized data access.
## Impact Assessment
- **Financial:** Minimal (Research-led discovery); potential for high cost if exploited by malicious actors.
- **Data Breach:** Exposure of internal Jira credentials and project data.
- **Operational:** Low; rapid remediation limited downtime.
- **Reputational:** Moderate; highlights risks of relying on AI-generated code fixes without human review.
## Indicators of Compromise
- **Network indicators:** Connections to `https://subdomain[.]oast[.]me` from GitHub runner IPs.
- **Behavioral indicators:** GitHub issues opened with titles containing shell metacharacters (e.g., `' ; curl ...`).
- **File indicators:** Changes to `.github/workflows/jira_issue.yml` involving direct `${{ }}` interpolation in `run:` blocks.
## Response Actions
- **Containment:** Snowflake disabled the vulnerable GitHub Actions workflow.
- **Eradication:** Reverted the AI-generated insecure code and implemented `jq` for safe input handling.
- **Recovery:** Rotated all compromised Jira API tokens and service account credentials.
## Lessons Learned
- **AI Risks:** AI "Autofix" tools can inadvertently introduce critical security regressions by bypassing established safe coding patterns.
- **Conditional Failures:** Logical flaws in GitHub Action `if:` conditions (e.g., checking for null objects) can render security gates useless.
- **Agentic Capability:** AI security agents are now capable of complex, multi-step exploitation and error correction without human input.
## Recommendations
- **Human-in-the-loop:** Mandate manual security reviews for all AI-generated PRs, especially those involving CI/CD pipelines.
- **Input Sanitization:** Always use environment variables for GitHub context expressions instead of direct shell interpolation.
- **Secret Scoping:** Ensure GitHub secrets are scoped to the minimum necessary repositories and environments.
- **Workflow Permissions:** Enforce "Read-only" `GITHUB_TOKEN` permissions by default in all workflows.