--- title: Snowflake flaw slips past AI checks, gets exploited by... description: An autonomous AI agent called Red Agent, built by Wiz, found and exploited a critical vulnerability in a GitHub Actions workflow inside Snowflake's... canonical: https://daily.dev/posts/snowflake-flaw-slips-past-ai-checks-gets-exploited-by-another-ai-lkkswogtq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Snowflake flaw slips past AI checks, gets exploited by another AI | daily.dev og:description: An autonomous AI agent called Red Agent, built by Wiz, found and exploited a critical vulnerability in a GitHub Actions workflow inside Snowflake's... og:url: https://daily.dev/posts/snowflake-flaw-slips-past-ai-checks-gets-exploited-by-another-ai-lkkswogtq og:image: https://api.daily.dev/og/posts/lkksWoGtq.png og:image:alt: Snowflake flaw slips past AI checks, gets exploited by another AI og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Snowflake flaw slips past AI checks, gets exploited by another AI **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary An autonomous AI agent called Red Agent, built by Wiz, found and exploited a critical vulnerability in a GitHub Actions workflow inside Snowflake's snowflake-connector-net repository, even though GitHub Copilot had reviewed the merged code and GitHub Advanced Security had scanned it without catching the flaw. The bug was introduced in PR#1218 merged June 18, when a change to how issue titles were handled allowed command injection via a crafted GitHub issue title; an existing bot-protection check failed because it was designed for pull requests, not issues. Red Agent's first exploit attempt failed on a syntax error, but it analyzed the failure, adjusted its payload, and succeeded on the second try, exfiltrating base64-encoded Jira credentials via an out-of-band callback and using them to gain read access to Snowflake's internal Atlassian environment covering engineering, security compliance, and bug bounty projects. Snowflake patched the workflow and rotated the Jira credential on June 23-24, and its forensic review found no unauthorized access beyond Wiz's testing. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did an AI agent exploit a GitHub Actions workflow vulnerability at Snowflake? Wiz's autonomous Red Agent found a command injection flaw in the jira_issue.yml workflow of Snowflake's snowflake-connector-net repository, introduced by PR#1218 merged on June 18. The workflow used a GitHub issue title unsanitized in a shell command, and an existing bot check failed because it was designed for pull requests, not issues, letting any GitHub user bypass it and exfiltrate Jira credentials. _daily.dev surfaces writeups like this for teams hardening CI/CD pipelines against injection attacks._ ### Did GitHub Copilot introduce the vulnerable code in the Snowflake GitHub Actions workflow? It is unclear whether Copilot introduced the vulnerability, but Copilot was listed as a co-author that reviewed the merged pull request and code change and marked it all-clear without noticing the critical injection flaw. GitHub Advanced Security also scanned the final revision and failed to flag the issue, showing that automated review tools missed the bug entirely. _developers weighing how much to trust AI code review can track cases like this on daily.dev._ ### How long was the Snowflake GitHub Actions vulnerability exploitable before it was found and patched? The vulnerability was live for five days, from its introduction on June 18 to discovery by Wiz's Red Agent, and Snowflake remediated it on June 23, the same day it was reported through HackerOne, rotating the exposed Jira credential the following day. Snowflake's forensic investigation found no evidence of unauthorized access beyond Wiz's own testing. _security teams tracking real-world exposure windows can follow incident breakdowns like this on daily.dev._ ## Similar posts on daily.dev - [Snowflake Cortex AI Escapes Sandbox and Executes Malware](https://daily.dev/posts/snowflake-cortex-ai-escapes-sandbox-and-executes-malware-tjmgifgcs) · Hacker News · 0 upvotes · 0 comments - [GitHub AI agent leaks private repositories via prompt injection attack](https://daily.dev/posts/github-ai-agent-leaks-private-repositories-via-prompt-injection-attack-ffq6gdzd6) · InfoWorld · 0 upvotes · 0 comments - ['GitLost' Flaw Leaks Private Data from GitHub's Agentic Workflows](https://daily.dev/posts/gitlost-flaw-leaks-private-data-from-github-s-agentic-workflows-jty8eoyaf) · Dark Reading · 0 upvotes · 0 comments - [‘GitLost’ Flaw Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos](https://daily.dev/posts/gitlost-flaw-lets-attackers-trick-github-ai-agent-into-leaking-private-repos-h2sgta49s) · DevOps.com · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#github-actions](https://daily.dev/tags/github-actions), [#snowflake](https://daily.dev/tags/snowflake), [#ai-security](https://daily.dev/tags/ai-security) [View this post on daily.dev](https://daily.dev/posts/snowflake-flaw-slips-past-ai-checks-gets-exploited-by-another-ai-lkkswogtq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Snowflake flaw slips past AI checks, gets exploited by another AI","url":"https://daily.dev/posts/snowflake-flaw-slips-past-ai-checks-gets-exploited-by-another-ai-lkkswogtq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/snowflake-flaw-slips-past-ai-checks-gets-exploited-by-another-ai-lkkswogtq"},"datePublished":"2026-08-19T11:12:59.882Z","dateModified":"2026-08-19T11:14:01.719Z","description":"An autonomous AI agent called Red Agent, built by Wiz, found and exploited a critical vulnerability in a GitHub Actions workflow inside Snowflake's...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2f900c915ac279e38cfad895f25604ad?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2f900c915ac279e38cfad895f25604ad?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/snowflake-flaw-slips-past-ai-checks-gets-exploited-by-another-ai-lkkswogtq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,github-actions,snowflake,ai-security","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Snowflake flaw slips past AI checks, gets exploited by another AI"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/snowflake-flaw-slips-past-ai-checks-gets-exploited-by-another-ai-lkkswogtq#faq","mainEntity":[{"@type":"Question","name":"How did an AI agent exploit a GitHub Actions workflow vulnerability at Snowflake?","acceptedAnswer":{"@type":"Answer","text":"Wiz's autonomous Red Agent found a command injection flaw in the jira_issue.yml workflow of Snowflake's snowflake-connector-net repository, introduced by PR#1218 merged on June 18. The workflow used a GitHub issue title unsanitized in a shell command, and an existing bot check failed because it was designed for pull requests, not issues, letting any GitHub user bypass it and exfiltrate Jira credentials. daily.dev surfaces writeups like this for teams hardening CI/CD pipelines against injection attacks."}},{"@type":"Question","name":"Did GitHub Copilot introduce the vulnerable code in the Snowflake GitHub Actions workflow?","acceptedAnswer":{"@type":"Answer","text":"It is unclear whether Copilot introduced the vulnerability, but Copilot was listed as a co-author that reviewed the merged pull request and code change and marked it all-clear without noticing the critical injection flaw. GitHub Advanced Security also scanned the final revision and failed to flag the issue, showing that automated review tools missed the bug entirely. developers weighing how much to trust AI code review can track cases like this on daily.dev."}},{"@type":"Question","name":"How long was the Snowflake GitHub Actions vulnerability exploitable before it was found and patched?","acceptedAnswer":{"@type":"Answer","text":"The vulnerability was live for five days, from its introduction on June 18 to discovery by Wiz's Red Agent, and Snowflake remediated it on June 23, the same day it was reported through HackerOne, rotating the exposed Jira credential the following day. Snowflake's forensic investigation found no evidence of unauthorized access beyond Wiz's own testing. security teams tracking real-world exposure windows can follow incident breakdowns like this on daily.dev."}}]} ```