An AI Wrote the Bug, an AI Approved It, an AI Exploited It
Wiz just published the cleanest story yet about AI agents sitting on both sides of the security fence. On June 18 a pull request co-authored by GitHub's Copilot Autofix landed in one of Snowflake's public repos. It replaced a secure pattern, environment variables plus jq parsing, with direct string interpolation of GitHub issue titles into a shell script. GitHub's AI-assisted security review approved the change. Five days later Wiz's autonomous security agent, Red Agent, found the hole, adapted its exploit when the first attempts failed, and walked out with a Jira API token authenticated as [email protected].
That token opened Snowflake's internal engineering, security compliance and bug bounty tracking projects. Anyone on the internet could have pulled the same trick, because the vulnerable workflow triggered on any public issue and a single quote in the title was enough to break out into command injection. Snowflake patched same-day after Wiz disclosed on June 23, rotated credentials, and audit logs show no external actor got there during the five-day window. The public writeup landed August 17: wiz.io/blog/red-agent-snowflake-copilot-cicd-bug
The part worth sitting with: this was not a model hallucinating an API. Copilot Autofix took working, safe code and rewrote it into a textbook injection, and the AI reviewer waved it through. Wiz's conclusion is blunt, AI-generated PRs must undergo the same static analysis and security scrutiny as human code, and reviewers need guardrails against AI replacing structured parsers with string interpolation, which is precisely what happened here.
The uncomfortable symmetry is that the only party in this story that performed at expert level was the attacking agent. It found the flaw, adapted when blocked, and exfiltrated autonomously. Right now offense is ahead of both generation and review, and it is ahead inside your CI/CD pipeline, the one place where code runs with credentials attached.
← Back to all articles
That token opened Snowflake's internal engineering, security compliance and bug bounty tracking projects. Anyone on the internet could have pulled the same trick, because the vulnerable workflow triggered on any public issue and a single quote in the title was enough to break out into command injection. Snowflake patched same-day after Wiz disclosed on June 23, rotated credentials, and audit logs show no external actor got there during the five-day window. The public writeup landed August 17: wiz.io/blog/red-agent-snowflake-copilot-cicd-bug
The part worth sitting with: this was not a model hallucinating an API. Copilot Autofix took working, safe code and rewrote it into a textbook injection, and the AI reviewer waved it through. Wiz's conclusion is blunt, AI-generated PRs must undergo the same static analysis and security scrutiny as human code, and reviewers need guardrails against AI replacing structured parsers with string interpolation, which is precisely what happened here.
The uncomfortable symmetry is that the only party in this story that performed at expert level was the attacking agent. It found the flaw, adapted when blocked, and exfiltrated autonomously. Right now offense is ahead of both generation and review, and it is ahead inside your CI/CD pipeline, the one place where code runs with credentials attached.
Comments