AI Risk Wire

Cases › security breach › LR-2026-0670

AI-assisted change introduced a script-injection flaw in a Snowflake GitHub workflow, later exploited by an autonomous research agent

Preliminary Why: 1 report: Infosecurity Magazine · subject to change · 1 independent report

Status: no action reported

Severity moderate
Reported 18 Aug 2026
Developer and model Wiz

No source states: loss or records, agent tool, could do, deployer, industry.

Severity moderate: Test: data or systems of others touched with a bounded scope stated. Fact: internal Snowflake Jira projects were readable with the extracted token, and the exposure window and access are bounded to the five-day period and Wiz.

An AI-generated security fix co-authored by GitHub Copilot Autofix changed a public GitHub Actions workflow in Snowflake's snowflakedb/snowflake-connector-net repository and placed an untrusted issue title directly into a shell command, introducing a script-injection flaw from June 18. Wiz's autonomous Red Agent, used in authorised security research through Snowflake's HackerOne programme, found the flaw on June 23, built a working exploit and obtained a Jira API token from a GitHub Actions runner. The token reportedly gave read access to internal engineering, security-compliance and bug-bounty projects. Wiz reported the issue the same day, Snowflake patched the workflow that day, and the credential was rotated on June 24. Snowflake's audit review found no access by anyone other than Wiz during the five-day exposure.

What happened

1 · How it was caughtWiz's Red Agent discovered the vulnerability on June 23, five days after the unsafe code was introduced, and Wiz reported it through HackerOne.

What was done

No source states an action or fix.

Risks

Credential and privilege abuse
Primary37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Short-lived, scoped credentials · Secrets kept out of the model's context · Separate identity for each agent · Least-privilege access for the agent · Alerts on unusual tool use · Activity logs · Sensitive-data checks on outbound data

Infrastructure / target

Multi-factor sign-in and password policy · Secrets scanning

Evidence

No source states: what the AI was doing, what went wrong, what it reached or did, when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 5 items from the primary sources

What happened, in order

  1. June 18 Pull request 1218 merged, introducing the vulnerable workflow change.
  2. June 23 Wiz's Red Agent discovered the vulnerability during scanning.
  3. June 23 Wiz reported the vulnerability to Snowflake through HackerOne.
  4. June 24 The Jira token was revoked and rotated.
  5. August 17 Wiz publicly disclosed the case.
Show every field, with its source and grade

The AI system

Developer
Wiz
C one secondary source states it
How much it acted alone
it acted alone, unwatched
C one secondary source states it
Stage of use
in research
C one secondary source states it

What happened

Earliest source we hold
2026-08-18
D inferred by us from the described behaviour, reason shown
Who caught it
an outside party
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
primary risk
RK03
D inferred by us from the described behaviour, reason shown

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Kinds of data exposed
api token, email address, base url
C one secondary source states it
Why this severity
Test: data or systems of others touched with a bounded scope stated. Fact: internal Snowflake Jira projects were readable with the extracted token, and the exposure window and access are bounded to the five-day period and Wiz.
D inferred by us from the described behaviour, reason shown

Notes on gaps

The sources give month and day only for most events; the year 2026 is inferred from the publication dates and is not stated in the quoted sentences.

LR-2026-0670 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON