{"schema_version":"0.10.0","id":"LR-2026-0670","record_version":1,"title":"AI-assisted change introduced a script-injection flaw in a Snowflake GitHub workflow, later exploited by an autonomous research agent","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":56.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.48,"unhedged_language":4.69},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Infosecurity Magazine · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Infosecurity Magazine · subject to change"}]},"sources_hash":"e850784fa603c5dfe1444e31f5c5c7ae385e346e0025cf942709a8ec909a4847"},"system":{"model_name":null,"model_version":null,"developer":"Wiz","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"full-auto","guardrails_present":[],"deployment_context":"research","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-08-18","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"An AI-generated security fix co-authored by GitHub Copilot Autofix changed a public GitHub Actions workflow in Snowflake's snowflakedb/snowflake-connector-net repository and placed an untrusted issue title directly into a shell command, introducing a script-injection flaw from June 18. Wiz's autonomous Red Agent, used in authorised security research through Snowflake's HackerOne programme, found the flaw on June 23, built a working exploit and obtained a Jira API token from a GitHub Actions runner. The token reportedly gave read access to internal engineering, security-compliance and bug-bounty projects. Wiz reported the issue the same day, Snowflake patched the workflow that day, and the credential was rotated on June 24. Snowflake's audit review found no access by anyone other than Wiz during the five-day exposure.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"none","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK03"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data or systems of others touched with a bounded scope stated. Fact: internal Snowflake Jira projects were readable with the extracted token, and the exposure window and access are bounded to the five-day period and Wiz.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":["api_token","email_address","base_url"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.linkedin.com/pulse/ai-agent-introduced-flaw-snowflakes-codethen-another-zelfe","publisher":"LinkedIn","date":"2026-08-18","type":"press","title":"AI Agent Introduced A Flaw in Snowflake’s Code—Then Another AI Agent Exploited It - LinkedIn","archived_url":null,"attachment":"first_report"},{"url":"https://www.infosecurity-magazine.com/news/wiz-ai-agent-finds-snowflake/","publisher":"Infosecurity Magazine","date":"2026-08-18","type":"press","title":"Wiz AI Agent Finds Critical Snowflake GitHub Repo Flaw Advanced Security Missed - Infosecurity Magazine","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.autonomy_level":"C","system.deployment_context":"C","system.developer":"C","event.incident_class":"C","event.agent_involved":"C","event.adversarial_actor":"C","event.detection_method":"C","impact.data_categories_exposed":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","event.trigger":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.autonomy_level":[{"source_index":1,"quote":"Wiz Research’s autonomous agent independently discovered and exploited the GitHub Actions injection, validated access to sensitive data in Snowflake’s internal Jira connector and assessed the blast radius, all without human intervention."}],"system.deployment_context":[{"source_index":0,"quote":"It occurred during authorised security research conducted by Wiz through Snowflake’s HackerOne vulnerability disclosure programme."}],"system.developer":[{"source_index":1,"quote":"The discovery has been attributed to Wiz Research’s Red Agent, an autonomous, AI-powered security research tool."}],"event.incident_class":[{"source_index":1,"quote":"The issue allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner by opening a GitHub issue with a specially crafted title."}],"event.agent_involved":[{"source_index":0,"quote":"An artificial intelligence-generated security fix introduced a vulnerability into one of Snowflake’s public GitHub repositories, before a separate autonomous AI security agent found the defect, exploited it and extracted credentials providing access to parts of the company’s internal Jira environment."}],"event.adversarial_actor":[{"source_index":0,"quote":"The incident did not result from an uncontrolled attack or criminal operation."}],"event.detection_method":[{"source_index":0,"quote":"Wiz disclosed the case publicly on August 17, saying its Red Agent autonomously identified a script-injection vulnerability in the snowflakedb/snowflake-connector-net repository, developed a working exploit and used credentials obtained from a GitHub Actions runner to access internal Snowflake Jira projects."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"That callback contained Base64-encoded values for the Jira API token, Jira user email address and Jira base URL."}],"impact.severity":[{"source_index":0,"quote":"Wiz said Snowflake concluded that it was the only third party to access the endpoint during the exposure period."}],"impact.severity_because":[{"source_index":0,"quote":"Wiz said Snowflake concluded that it was the only third party to access the endpoint during the exposure period."}],"event.summary":[{"source_index":0,"quote":"An artificial intelligence-generated security fix introduced a vulnerability into one of Snowflake’s public GitHub repositories, before a separate autonomous AI security agent found the defect, exploited it and extracted credentials providing access to parts of the company’s internal Jira environment."},{"source_index":0,"quote":"The episode is particularly significant because the unsafe change was co-authored by GitHub Copilot Autofix, a tool expressly intended to help developers remediate security findings."},{"source_index":0,"quote":"Wiz disclosed the case publicly on August 17, saying its Red Agent autonomously identified a script-injection vulnerability in the snowflakedb/snowflake-connector-net repository, developed a working exploit and used credentials obtained from a GitHub Actions runner to access internal Snowflake Jira projects."},{"source_index":0,"quote":"The exposed token reportedly provided read access to engineering, security compliance and bug-bounty tracking projects."},{"source_index":0,"quote":"Snowflake fixed the vulnerable workflow on the day it received Wiz’s report and rotated the affected credential the following day."},{"source_index":0,"quote":"Snowflake’s review of its audit logs found no evidence that anyone other than Wiz accessed the affected endpoint during the five days in which the vulnerability was present."}]},"notes_on_gaps":"The sources give month and day only for most events; the year 2026 is inferred from the publication dates and is not stated in the quoted sentences. No model name, version, harness, tool list or permission scope for the Red Agent or Copilot Autofix is stated, so those fields are omitted. The exploit timing and time to contain in hours are not stated. Most facts come from Wiz, a vendor with a commercial interest, and from press; Snowflake's no-unauthorised-access conclusion is reported second-hand. Judgements: failure_class silent_wrong_state, root_cause oversight, responsible_party shared, adversarial_actor none (authorised research), detection_method third_party, severity moderate, and the control outcomes were assigned from the sources' descriptions. Trigger and country were left out because no source states them. Source 1 spells Copilot Autofix as Autifx and attributes the missed finding to GitHub Advanced Security; this is noted but not used as a field value. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Infosecurity Magazine · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"caught","text":"Wiz's Red Agent discovered the vulnerability on June 23, five days after the unsafe code was introduced, and Wiz reported it through HackerOne.","quote":"According to Wiz’s technical account, its Red Agent discovered the vulnerability while scanning Snowflake’s public GitHub organisation on June 23, five days after the unsafe code was introduced.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.linkedin.com/pulse/ai-agent-introduced-flaw-snowflakes-codethen-another-zelfe","https://www.infosecurity-magazine.com/news/wiz-ai-agent-finds-snowflake/"]},"analysis":{"sections":{"timeline":[{"text":"Pull request 1218 merged, introducing the vulnerable workflow change.","quote":"It went live five day earlier, on June 18, when the pull request (PR) #1218 was merged on GitHub.","source_index":1,"when":"June 18"},{"text":"Wiz's Red Agent discovered the vulnerability during scanning.","quote":"According to Wiz’s technical account, its Red Agent discovered the vulnerability while scanning Snowflake’s public GitHub organisation on June 23, five days after the unsafe code was introduced.","source_index":0,"when":"June 23"},{"text":"Wiz reported the vulnerability to Snowflake through HackerOne.","quote":"Wiz reported the vulnerability through Snowflake’s HackerOne programme on June 23 under report number 3819931.","source_index":0,"when":"June 23"},{"text":"The Jira token was revoked and rotated.","quote":"The Jira token was revoked and rotated on June 24.","source_index":0,"when":"June 24"},{"text":"Wiz publicly disclosed the case.","quote":"Wiz disclosed the case publicly on August 17, saying its Red Agent autonomously identified a script-injection vulnerability in the snowflakedb/snowflake-connector-net repository, developed a working exploit and used credentials obtained from a GitHub Actions runner to access internal Snowflake Jira projects.","source_index":0,"when":"August 17"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.linkedin.com/pulse/ai-agent-introduced-flaw-snowflakes-codethen-another-zelfe","https://www.infosecurity-magazine.com/news/wiz-ai-agent-finds-snowflake/"]}}