GitHub Copilot Autofix Introduced the Snowflake Vulnerability That Wiz Then Exploited

2. GitHub Copilot Autofix Introduced the Snowflake Vulnerability That Wiz Then Exploited

On June 18, 2026, a GitHub Copilot Autofix commit landed in Snowflake's public snowflake-connector-net repository via PR #1218. The commit removed an existing safe input pattern that passed issue titles through an env: variable and replaced it with direct ${{ github.event.issue.title }} shell interpolation. Five days later, on June 23, Wiz Research's autonomous Red Agent scanned Snowflake's GitHub organization, flagged the jira_issue.yml workflow as injectable, and exfiltrated a Jira credential via a crafted issue title. Snowflake remediated the flaw the same day, rotated the credential, and confirmed via audit logs that Wiz was the only actor during the exposure window.

The competitive weight here falls on Microsoft and GitHub. Copilot Autofix is positioned as a security accelerant, a tool that closes vulnerabilities faster than human review cycles. This incident inverts that claim with a concrete, dated commit. The AI assistant did not introduce a novel bug class; script injection via untrusted GitHub Actions inputs is well-documented. What it did was delete a working mitigation and substitute a pattern that looks superficially correct but breaks under template expansion. For enterprises evaluating agentic code tools, particularly those with public repositories and automated CI/CD pipelines, the incident reframes the risk calculus: AI-generated fixes require the same adversarial review as any other untrusted code, possibly more, because they carry an implicit authority signal that human reviewers may under-scrutinize.

The broader pattern is the collision of two agentic systems. Copilot Autofix introduced the flaw autonomously; Wiz Red Agent found and proved it autonomously. Both operated faster than any human review loop would have. That speed asymmetry is the real signal to watch. As AI-powered red-teaming tools proliferate, the window between an AI-introduced vulnerability and its discovery by an adversarial agent will compress. Security teams should treat AI commit co-authors as a distinct risk surface requiring automated workflow-injection scanning at merge time, not post-deployment.

Source: Red Agent Exploits Snowflake Vuln Created by Copilot Autofix