Copilot Autofix Wrote the Bug. An AI Found It in 5 Days.

TL;DR

On August 17, Wiz published a post-mortem that should ruin a few standups. In June, GitHub's Copilot Autofix submitted a "security" patch to a public Snowflake repository that deleted the one line stopping shell injection, and opened a fresh remote-code-execution hole in its place. Five days later, Wiz's autonomous Red Agent found it, exploited it, and exfiltrated a live Jira API token, all on its own. An AI wrote the vulnerability, an AI found it, and the humans mostly just read the audit logs afterward.

What actually happened

The target was snowflakedb/snowflake-connector-net, a public repo with a GitHub Actions workflow named jira_issue.yml. It runs on the issues: opened event, which means any GitHub user on the planet can trigger it just by filing an issue. That is fine, as long as the workflow treats the issue title as data and never as code.

On June 18, a pull request (PR #1218) changed that. The commit was co-authored, per the git trailer, by "Copilot Autofix powered by AI." The blame, at least, was well documented. The bot's patch removed the workflow's existing sanitized input pattern and replaced it with direct string expansion inside a shell command. That single edit turned a safe workflow into an unauthenticated RCE.

The one line that mattered

The original workflow did the boring, correct thing: it bound the issue title to an environment variable and passed it to jq with the --arg flag. That keeps quoting inside the JSON parser, where a stray apostrophe is just a character, not a command boundary. Copilot Autofix threw that out and swapped in a pattern that piped the raw title through echo and sed, escaping quotes with a couple of substitutions.

The problem is ordering. In a GitHub Actions run: block, the template value is expanded into the script before the shell ever executes, so sed never gets a chance to sanitize anything. A single apostrophe in the issue title closes the string early and hands the rest to the shell as live commands. The escaping technically ran, just far too late to matter. It is like bolting the vault door after the cash is already on the sidewalk.

Then the other AI showed up

Wiz's Red Agent is an autonomous offensive-security tool, announced at RSA 2026 and pushed to public preview in April as part of Wiz's attack-surface management. It maps targets, reasons about how each endpoint could break, and adapts its payloads based on what it observes, without a human writing the exploit.

Its CI/CD scanner flagged jira_issue.yml as injectable. The first attempt failed: the agent used a # comment character that swallowed a closing parenthesis and threw a bash syntax error. Instead of giving up, the Red Agent read the error, understood why its payload broke, and rewrote it to cleanly close the shell block. That self-correction is the part worth staring at. This was not a static scanner replaying a canned string; it debugged its own exploit.

The working payload was an issue title that closed the shell command, then appended a curl call to an out-of-band domain, base64-encoding the Jira token and its URL into the query string. Seconds after the issue was filed, Wiz got an out-of-band callback from a GitHub Actions runner carrying the credential.

The blast radius

The exfiltrated Jira API token authenticated as [email protected] against Snowflake's Atlassian instance, with read access to engineering, security-compliance, and bug-bounty projects. In other words, a stranger opening a GitHub issue could have read Snowflake's internal security tickets. That is roughly the last place you want an anonymous read primitive.

The cleanup was fast and clean. Wiz reported through Snowflake's HackerOne program (report #3819931) on June 23. Snowflake patched the same day, restoring the env: and jq --arg pattern in PR #1402, rotated the token the next day, and confirmed via audit logs that Wiz's testing IPs were the only actors during the five-day window. Snowflake's statement notes the disclosure was "immediately investigated and remediated," with no evidence of unauthorized access. This is what a good outcome looks like: the exposure was real, but the response was textbook.

Why builders should care

The uncomfortable lesson is not that Copilot Autofix is bad. It is that an AI patcher optimizes for the alert in front of it, not for the reason a specific pattern was chosen in the first place. The jq --arg approach was almost certainly put there deliberately to stop this exact class of bug. The bot could not see that history, so it "simplified" the code straight back into the vulnerability, and slapped a security-fix label on top.

Pair that with an attacker that self-corrects in seconds, and the window between "regression merged" and "regression exploited" collapses to days. The old assumption that a freshly introduced bug has a comfortable grace period before anyone notices is now, officially, wishful thinking. AI-authored pull requests need the same static analysis, review, and skepticism you would give a stranger's first commit, because functionally that is what they are.

Key Takeaways

• An AI fix opened the hole. Copilot Autofix removed a safe jq --arg pattern in snowflake-connector-net and introduced an unauthenticated RCE via GitHub Actions.
• An AI attacker closed it. Wiz's Red Agent found, debugged, and exploited the bug autonomously, exfiltrating a live Jira token in seconds.
• Ordering is everything. In a run: block, template values expand into the shell before sed escaping runs, so the sanitization never fires.
• Five days, not five months. The regression went from merge to working exploit in under a week, thanks to autonomous discovery.
• Blast radius was internal Jira. The token read Snowflake's engineering, compliance, and bug-bounty projects; the fix, token rotation, and audit-log check all landed within a day.
• Treat AI PRs as untrusted input. Autofix optimizes for the alert, not for why a guardrail exists. Review its diffs like a stranger's, and keep credentials short-lived.

Sources: Wiz Blog: Red Agent Exploits Snowflake Vuln Created by Copilot Autofix, Wiz Blog: Introducing the Wiz Red Agent, snowflakedb/snowflake-connector-net (GitHub), GitHub Copilot.