Snowflake Patches 5-Day GitHub Actions Flaw Introduced by Copilot Autofix
Updated
Updated · Wiz · Aug 17
Snowflake Patches 5-Day GitHub Actions Flaw Introduced by Copilot Autofix
3 articles · Updated · Wiz · Aug 17
Summary
June 23, 2026, Snowflake fixed a critical GitHub Actions vulnerability in its snowflake-connector-net repository the same day Wiz disclosed it, then revoked and rotated the exposed Jira credential.
The flaw let any GitHub user trigger arbitrary commands by opening an issue with a crafted title because an AI-assisted June 18 commit replaced a safe env-and-jq pattern with direct shell interpolation.
Wiz’s Red Agent adapted its exploit after an initial bash error and exfiltrated base64-encoded Jira credentials from a GitHub Actions runner, gaining read access to engineering, security compliance and bug-bounty projects.
Audit logs showed the exposure lasted 5 days and that only Wiz accessed the endpoint during that window; Wiz said all proof-of-concept data was securely deleted.
The incident underscores how AI coding tools can reintroduce insecure patterns and how automated security agents are shrinking discovery windows to hours or days.