# AI Coding Assistant Creates Critical Vulnerability in Snowflake Repository

> How an AI coding assistant introduced a critical script injection flaw that was then autonomously exploited by another AI agent.
> By Dave · 2026-08-20
> Source: https://otf-kit.dev/blog/ai-vulnerability-snowflake

An autonomous attacker found, weaponized, and exfiltrated data from a public Snowflake repository in under a week — and there was no human at the keyboard. The exploit was authored by Wiz's red agent, an AI-powered offensive security tool, and it landed on June 23, 2026, five days after the vulnerable commit was merged. Before you read another paragraph: that capability is worth pausing on. A system that scans a public repo, reasons about a shell-script template, crafts a payload that breaks out of an `echo` string, and exfiltrates Jira credentials via an out-of-band callback is a real engineering achievement. The threat model for public software just changed, and Wiz showed the shape of the change in one clean demo.

The scary part is what the agent found. The vulnerability it exploited was authored by another AI.

## 1. The five-day exploit chain

On June 18, 2026, GitHub Copilot Autofix co-authored a commit to the public `snowflakedb/snowflake-connector-net` repository. Per security findings published by Wiz, the assistant replaced an existing sanitized input pattern inside a `run:` block with direct string expansion in a shell script. The diff looked benign — the kind of refactor a tired reviewer rubber-stamps at 11pm. It reintroduced a classic script injection vector.

Five days later, on June 23, Wiz's red agent was running a routine scan against public repositories. It located the GitHub Actions workflow flaw immediately. By crafting an issue title that broke out of the `echo` string during template expansion, the agent executed arbitrary commands inside a GitHub Actions runner with no human input. The exploit did not stop at code execution — it pulled Jira credentials from the workflow's secret store via an out-of-band callback, and from there the attacker had read access to Snowflake's internal engineering, security compliance, and bug bounty tracking projects.

Gal Nagli, head of threat exposure at Wiz, put it bluntly in the disclosure: AI agents are surfacing, in the wild, vulnerabilities traditional pipelines routinely miss. Both halves of that sentence are true, and both halves matter.

## 2. The mental model that broke

Code review works because the reviewer holds a model of what the author was thinking. Even when you would have written it differently, you can ask *why* and get an answer. AI-authored commits break that contract. The reviewer sees a clean diff. They do not see the agent's chain of reasoning, the training data it leaned on, or the alternatives it discarded.

The Snowflake commit is the textbook case. The original author had explicitly written a sanitized input pattern — a conscious choice to defend against exactly the injection the AI later reintroduced. A human reviewer would have noticed the diff replacing a quoted shell expansion with an unquoted one inside a heredoc. An AI assistant rewrote it without preserving the original author's intent, because it does not carry that intent across commits. The safety property was encoded in prose ("we sanitize titles because…"), not in the code itself, and the agent had no reason to preserve prose.

This is the new class of supply-chain risk: machine-authored logic that is locally correct and globally dangerous. The change compiles. The diff looks reasonable. The unit tests pass. Nothing in static analysis lights up red. But the human mental model that connected this file to "we don't trust issue titles" has been silently discarded.



![A single line in a YAML workflow — the diff that broke the mental model](https://cdn.otf-kit.dev/blog/ai-vulnerability-snowflake/inline-1.png)



## 3. The asymmetry that should worry you

Here is the math. Wiz's red agent went from a public commit to credential exfiltration in roughly 120 hours, with no human keystrokes in between. The defensive fix took longer, because defenders woke up to a Slack message, opened a Jira ticket, context-switched, and routed the patch through a normal review pipeline. Attackers now move at agent speed. Defenders still move at human speed.

Copilot Autofix is genuinely useful — it closes real tech debt, replaces deprecated APIs, and saves reviewers hours per week. The Snowflake incident is not an indictment of Autofix. It is a reminder that every automated remediation pass is also a moment where a human mental model can silently evaporate. Multiply that across every public repo that uses AI remediation, and the structural problem appears: a thousand invisible removals of sanitization logic, each locally plausible, each globally load-bearing.

## 4. How to defend, concretely

Every defensive control here is something you can ship this week. None of it requires a new vendor.

```yaml
# .github/workflows/triage.yml — protect against issue-title injection
on:
  issue_comment: { types: [created] }
jobs:
  triage:
    runs-on: ubuntu-latest
    steps:
      - name: Echo title safely
        env:
          TITLE: ${{ github.event.comment.body }}
        run: |
          # Always quote; never expand $TITLE into the shell unquoted.
          printf '%s\n' "$TITLE"
```

Four rules that actually move the needle:

1. **Scope secrets per workflow.** The Snowflake incident leaked Jira credentials because the workflow that handled issue titles had access to them. Move credentials to dedicated jobs that only run on protected paths. A triage workflow should never hold a Jira PAT.

2. **Branch protection for AI-touched commits.** Most AI remediation tools leave a `Co-authored-by:` trailer. Configure your branch protection rule to require an extra human reviewer for any commit matching that trailer. One setting, real teeth.

3. **Run SAST against AI-modified files only.** Semgrep, CodeQL, or a custom ruleset scoped to any file the AI touched in a given PR. The Snowflake bug was detectable with one rule: "shell expansion of `github.event.*` without quotes." Write that rule once, apply it to every workflow file.

4. **Run agent-style scanners against your own public mirrors.** Open-source equivalents of Wiz's red agent are catching up — start with the OWASP Agentic AI Top 10 and the NIST AI Red Team guidance. Run them nightly. Treat your GitHub Actions surface the way you treat a public S3 bucket.

```bash
# one-shot semgrep rule for the Snowflake bug class
semgrep --config - <'EOF' .github/workflows/
rules:
  - id: unquoted-github-context-in-run
    pattern-regex: '\$\{\{\s*github\.event\.[a-zA-Z._]+\s*\}\}'
    message: >-
      GitHub Actions context expanded unquoted — wrap in env: and quote.
    severity: ERROR
EOF
```

## 5. The part that does not change when the model does

Here is the durable bit, and it has nothing to do with which coding model wins next quarter. Every AI remediation system — Copilot Autofix, the Cursor bug bot, the one shipping next month — will eventually rewrite a piece of your code in a way that erases a safety property a human encoded in prose. That is not a Copilot problem. It is an interface problem, and the fix does not live in the model.

The fix lives in the surface that survives the model: a shared component layer that both AI and humans write against, where the safety property is encoded in the component itself, not in a comment above it. A button cannot inject, because the button does not expand issue titles. A form cannot exfiltrate, because the form does not call Jira. The dangerous logic stops living in `run:` blocks that any agent can rewrite, and starts living in primitives that ship with type signatures, audit logs, and a public test suite.



![human mental model → AI rewrites diff → unsafe logic shipped → agent exploits → durable co](https://cdn.otf-kit.dev/blog/ai-vulnerability-snowflake/inline-2.png)



That is the layer worth investing in. The agents will keep getting faster on both sides. The diffs will keep looking cleaner. The only thing that scales is the layer underneath the churn — the part that does not change when the model does.

## Closing

Five days from commit to credential exfiltration is the new floor, not the ceiling. The Snowflake incident is a useful scare because the bug was small, the diff was small, and the entire chain fit inside one GitHub Actions workflow. Every team that uses AI remediation in a public repo should treat this as a tabletop exercise: pull your last thirty days of AI-authored commits, run them through a SAST pass, and look for the silent deletions of sanitization logic that a human reviewer would have caught but an AI co-author erased. That is the work — Wiz's red agent already did the proof of concept, and it will not be the last.