Wiz's Red Agent exfiltrated Snowflake Jira credentials through a Copilot-approved GitHub Actions injection
PR #1218 in Snowflake's repo replaced a safe `env:` + `jq --arg` pattern with direct interpolation of `github.event.issue.title` into a shell `run:` step; GitHub Advanced Security scanned the final revision without flagging it, and Copilot co-authored the review and marked the change all-clear. Wiz's autonomous Red Agent found and exploited it — when its initial `#` payload threw a bash syntax error, the agent analyzed the error itself and switched to `; echo '`, extracting credentials for Snowflake's internal Jira (`[redacted]`) with read access to engineering, security compliance and bug bounty projects. Live June 18, reported and patched June 23, token rotated June 24, disclosed August 17 — a full loop of AI introducing, AI approving, and AI exploiting the same bug.
Source
↳ Follow the thread