An autonomous AI agent broke into Snowflake's Jira through a bug GitHub's AI review had cleared

Wiz Research's autonomous "Red Agent" scanned Snowflake's public GitHub organization, found a script-injection flaw in a GitHub Actions workflow, and exploited it entirely on its own, five days after the flaw went live. The vulnerable pattern, an issue title interpolated directly into a shell command, replaced a safer parsing pattern in a June 18 pull request whose final commit credits "Copilot Autofix powered by AI" as a co-author; Wiz updated the post on August 17 to clarify that Copilot reviewed and approved the merged change without flagging the vulnerability, and that it remains unclear whether the code itself was AI-written. The workflow also carried an if: condition that "appeared protective" but always evaluated true on the event type in question, so every GitHub user passed the gate. When Red Agent's first exploit attempt failed with a bash syntax error, it "autonomously analyzed the syntax execution error" and adjusted its payload, then received a callback carrying a base64-encoded Jira token that authenticated as qa@snowflake.net with read access to Snowflake's engineering, security-compliance, and bug-bounty projects. Snowflake patched the workflow the same day Wiz reported it (June 23) and confirmed via audit logs that only Wiz's own testing IPs touched the exposed endpoint during the five-day window.

Why it matters: Wiz walked back the headline claim that an AI wrote the bug. Its narrower finding is that an AI reviewer signed off on a change that deleted a guardrail whose reasoning it had no way to see, and a second AI found the opening in under a week. If your process treats an AI code reviewer's approval the way it would treat a senior engineer's, this is the incident that says why it shouldn't, yet.