Wiz says Red Agent exploited a Snowflake workflow flaw introduced by Copilot

Why it matters

The same AI tools accelerating software delivery can erase defensive choices embedded in old code. Wiz is betting autonomous testing can catch those regressions before real attackers do.

Assaf Rappaport (@assaf_rappaport) and his Wiz co-founders are betting that autonomous security agents can keep pace with software increasingly written by other AI systems. In an incident report, Wiz says GitHub Copilot Autofix helped create an injection flaw in a Snowflake workflow, then Wiz's Red Agent found and exploited it.

Wiz says the vulnerable code entered Snowflake's public .NET connector repository on June 18th. Red Agent detected the flaw during authorized research through Snowflake's HackerOne program and reported it on June 23rd. Snowflake patched the workflow that day and rotated the affected credential on June 24th.

Rappaport founded Wiz in 2020 with Ami Luttwak, Yinon Costica and Roy Reznik after the group built Adallom and later worked together at Microsoft. Google agreed to buy Wiz for $32 billion and completed the acquisition on March 11th. Wiz operates as a Google Cloud subsidiary while retaining its brand.

A security fix removed a security boundary

The flaw sat in .github/workflows/jira_issue.yml, a GitHub Actions workflow that created Jira tickets when users opened issues in Snowflake's repository. Any GitHub user could trigger the workflow, and the job had access to a Jira email address, base URL and API token stored as secrets.

The June 18th commit replaced a safer input-handling pattern. Previously, the workflow assigned the issue title to an environment variable and used jq to construct the Jira request. The new version inserted ${{ github.event.issue.title }} directly into a shell command before attempting to escape quotation marks with sed.

That sequence mattered. GitHub expands expressions before the runner executes the generated shell script. A title containing a single quote could therefore escape the surrounding string and append arbitrary commands. GitHub's security documentation specifically identifies issue titles as untrusted input and warns against placing them directly in inline scripts. Its preferred mitigation is the intermediate environment-variable pattern the commit removed.

The commit metadata lists "Copilot Autofix powered by AI" as a co-author. Wiz attributes the insecure rewrite to the AI-generated autofix. The public record establishes Copilot's involvement, while the supplied sources do not establish how much human review the change received. The failure therefore crossed both generation and review: an AI-produced change removed an existing defensive pattern, and the resulting code reached the main branch.

A second workflow mistake widened the opening. An if condition checked github.event.pull_request.user.login even when processing an issue event. Wiz says the pull-request field was null in that context, so the inequality test evaluated as true and failed to restrict who could run the job.

Red Agent rewrote its exploit after the first attempt failed

According to Wiz's incident report, Red Agent opened a specially titled issue intended to execute commands on the GitHub Actions runner and send the Jira credentials to an external listener.

The first payload failed with a Bash syntax error because a comment character swallowed a closing parenthesis. According to Wiz, Red Agent analyzed that error, changed the payload to close the shell expression with ; echo ', and tried again. The second attempt returned the credentials within seconds from a GitHub-hosted runner.

Wiz says the token authenticated as qa@snowflake.net and provided read access to Snowflake Jira projects covering engineering, security compliance and bug-bounty work. The report does not claim that Red Agent gained administrative control of Snowflake's Jira or production data systems.

Snowflake said in a statement included in the Wiz report that it immediately investigated and remediated the vulnerability and found no evidence of unauthorized access. Wiz says Snowflake's audit logs matched the anomalous activity to its testing infrastructure and that Wiz deleted the data accessed during its proof of concept. Those forensic conclusions rely on Wiz and Snowflake's account; the underlying audit logs are not public.

According to Wiz's report, Snowflake's June 23rd patch restored the environment-variable and jq --arg parsing pattern. The associated pull request was merged the same day.

Wiz turns security research into product proof

Red Agent extends Wiz's security research into continuous offensive testing. Wiz announced Red Agent in March and later made it generally available, according to its product announcement. Wiz says the product discovers targets, reasons through application behavior, adjusts attacks based on responses and validates whether a flaw is exploitable. Wiz has not published enough independent testing to establish how broadly those capabilities transfer across customer environments.

The Snowflake case captures the operating problem Rappaport is building around. AI coding systems can make small edits across large repositories faster than human reviewers can reconstruct the security rationale behind every old line. Autonomous testing agents can compress the discovery window in response. Here, five days separated the vulnerable merge from the agent's report.

That speed does not remove human responsibility. Copilot's contribution carried human co-authors and passed through Snowflake's repository controls. Red Agent operated under an authorized disclosure program, while Snowflake's security team handled the patch, credential rotation and forensic review. The practical model is a tighter loop between automated code generation, automated adversarial testing and accountable human approval. Wiz is positioning itself to sell the attacking half of that loop.