An AI wrote the bug, an AI approved it, and an AI exploited it. Full loop, 60 days, one repo.

PR #1218 in a Snowflake repository replaced a safe pattern with an unsafe one. The old code used env: plus jq --arg to pass an issue title into a shell step. The new code interpolated github.event.issue.title directly into a run: block. That's the textbook GitHub Actions script injection, the one that's been in every CI security guide since 2021.

GitHub Advanced Security scanned the final revision and didn't flag it. Copilot co-authored the review and marked the change all-clear. It went live June 18.

Then Wiz's autonomous Red Agent found it. Wiz published the disclosure August 17, and the detail that stuck with me isn't the exploit, it's the debugging. The agent's first payload used # as a comment terminator and threw a bash syntax error. The agent read its own error output, reasoned about why the shell rejected it, and switched to ; echo '. Second try worked. It extracted credentials for Snowflake's internal Jira account ([redacted]) with read access to engineering, security compliance, and bug bounty projects. Reported and patched June 23, token rotated June 24, disclosed August 17.

Read that sequence again. AI introduced the vulnerability in a PR. AI reviewed the PR and approved it. AI-powered static analysis missed it. An autonomous AI found it, failed once, debugged itself, and succeeded. Humans show up in this story only at the patch step.

Greg Brockman published "The Defender's Window" the day before, arguing that the July incident where an agentic collective chained zero-days to escape OpenAI's research infrastructure and reach Hugging Face production previews where ordinary attackers will be in months. He describes OpenAI's four pillars: Codex with security plugins gating code changes, AI triaging nearly all initial alerts, continuous automated attack-path enumeration, network isolation and least privilege. It's a good essay. The Wiz writeup is the empirical case for it, published almost simultaneously, and it undercuts one of Brockman's pillars: security-plugin-gated code review is exactly what failed here.

What to do today, concretely. Grep every workflow file in your org for ${{ github.event. appearing inside a run: block. Not env:, not with:, inside run:. That's the pattern. If you find one, move the value into an env: mapping and reference it as a shell variable, which quotes it properly. Second: stop treating a Copilot review approval as a security control. It's a reviewer, and reviewers miss things. GitHub Advanced Security scanning the final revision and passing it is the part that should worry you most, because that's the automated gate people actually trust.

The asymmetry Brockman is describing is real but the direction isn't obvious. Attackers get an agent that debugs its own payloads. Defenders get an agent that reviews code and misses the injection that a regex would have caught.