An AI bot’s suggested code fix turned into a live exploit within five days, according to research Wiz published Monday.
The trouble started June 18, when a pull request co-authored by Copilot Autofix, GitHub’s AI security-fix bot, landed in the public snowflake-connector-net repository. The change rewrote a GitHub Actions workflow called jira_issue.yml so that it pushed an issue’s title straight into a shell command, dropping an earlier pattern that kept untrusted text out of the shell. Anyone with a GitHub account could trigger the workflow, and a guard condition meant to limit who could never actually fired.
Snowflake learned of the hole on June 23, when Wiz’s autonomous research agent, Red Agent, exploited it through the company’s bug bounty program. The agent walked away with a Jira API token from the runner’s environment, after one failed payload that hit a bash syntax error and a second attempt with a revised one.
Snowflake fixed the workflow the same day it received the report, rotated the affected credential the next day, and told Wiz its audit logs showed no other actor reached the exposed systems during the five-day window.
The episode is a case study in the limits of AI-assisted patching: the suggestion mechanism delivered a plausible fix, and the human review step approved it without catching the security pattern it removed.
