Wiz's Autonomous Red Agent Breached Snowflake's Jira in 5 Days Through a Bug GitHub Copilot's Own AI Review Cleared. Sell the Audit That Re-Checks AI-Approved Code.

A security research writeup that hit the Hacker News front page shows something sharper than "AI writes buggy code": it shows AI-authored code passing an AI-run security review, then getting broken into by a different AI five days later.

What happened

On June 18, 2026, a pull request (PR #1218) in Snowflake's public GitHub repository replaced a safe input-handling pattern in a GitHub Actions workflow with direct string interpolation: TITLE=$(echo '${{ github.event.issue.title }}' | sed 's/"/\\"/g' | sed "s/'/\\\'/g"). The commit credits "Copilot Autofix powered by AI" as co-author. The workflow triggered on issue creation, meaning "any GitHub user" could fire it with a specially crafted issue title. Critically, "GitHub's AI-assisted security review did not flag the resulting critical vulnerability" — an update to the post clarifies Copilot itself "checked the merged PR...identified it as all-clear without noticing the critical vulnerabilities."

Five days later, Wiz's autonomous Red Agent found the bug on its own. Its first exploitation attempt failed — a payload using # to comment out trailing shell syntax "caused an unexpected EOF bash error because it also ate the closing )" — and the agent self-corrected by using ; echo ' to properly close the shell syntax. It then exfiltrated a base64-encoded token authenticating as qa@snowflake.net, which granted "read access across Snowflake's engineering, security compliance, and bug bounty tracking projects." All of this happened "without human intervention." Snowflake patched the same day via commit 1dc7766 (PR #1402) and rotated the exposed token the next day.

The gap this exposes

The vulnerability wasn't caught because a human wasn't looking — it wasn't caught because the AI tool doing the looking was either the same system that introduced the bug, or a system with the same class of blind spot. That's a structural gap, not a one-off mistake: any team that treats "an AI reviewed this PR" as equivalent to "this PR is safe" has the same exposure Snowflake had for five days.

The business opportunity

The audit is straightforward to scope: pull every PR in a client's repository where an AI coding assistant is listed as author or co-author, and manually re-check the diffs an AI review tool already marked clean. Prioritize CI/CD workflow files that trigger on user-controllable input — issue titles, PR titles, branch names — since that's the exact class of injection vulnerability in this case, and it's a pattern greppable across any GitHub Actions setup. The deliverable isn't a general pentest; it's a specific re-check of code that already has an AI's stamp of approval on it.

Who buys this

Teams using AI coding assistants (Copilot, Cursor, or similar) with AI-assisted or automated PR review turned on, especially teams whose GitHub Actions workflows respond to public, user-controllable triggers. The pitch is stronger with technical buyers because the case is fully verifiable: PR #1218, commit 1dc7766, HackerOne report #3819931.

Bottom line

An AI reviewer approving AI-generated code is not the same as a second, independent check — the Snowflake case is proof of that gap with a full paper trail. That makes "who re-audits your AI-approved PRs" a sellable, recurring question for as long as AI assistants keep authoring both the code and the review of it.

Source: https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug