Wiz Research's autonomous "Red Agent" found and exploited a script injection flaw in Snowflake's public snowflake-connector-net repository, using nothing but a crafted GitHub issue title to steal credentials for Snowflake's internal Jira.
The vulnerability had been introduced five days earlier by GitHub Copilot Autofix — an AI tool built to fix security bugs.
No CVE ID has been assigned. Wiz reported the issue through Snowflake's HackerOne program as report #3819931. The bug sat in the jira_issue.yml workflow, which fired on issues: opened and interpolated the attacker-controlled title straight into a run: block — arbitrary command execution on the Actions runner for any unauthenticated GitHub user.
How an AI "Autofix" Created the Flaw
Commit 4a1b8ce (PR #1218), co-authored by Copilot Autofix powered by AI, deleted the repository's safe pattern — the issue title passed through an env: variable and built into JSON with jq --arg — and replaced it with direct string expansion:
- env:
- ISSUE_TITLE: ${{ github.event.issue.title }}
- run: jq -n --arg title "$ISSUE_TITLE" ...
+ run: TITLE=$(echo '${{ github.event.issue.title }}' | sed ...)The sed escaping runs after GitHub expands the template, so a single quote in the title breaks out of echo '...'. Red Agent's first payload triggered a bash EOF error; the agent analysed the failure, rewrote the payload, and exfiltrated JIRA_API_TOKEN, JIRA_USER_EMAIL and JIRA_BASE_URL as base64 to an out-of-band listener.
Why the Workflow's Security Gate Did Nothing
The workflow's if: condition is compared github.event.pull_request.user.login against a bot account. In issues events that object is always null, reducing the check to null != 'whitesource-for-github-com[bot]' — permanently true. Every GitHub user passed the gate.
The stolen token was authenticated as [email protected] to snowflakecomputing.atlassian.net, granting read access to engineering, security compliance and bug bounty projects. Snowflake's audit logs matched every anomalous query to Wiz's testing IPs and found no evidence of unauthorised third-party access.
How to Check Your Own Workflows
Any workflow triggered by issues, issue_comment, pull_request_target or discussion that places ${{ github.event.* }} inside a run: block is exploitable the same way. The open-source Actions auditor zizmor flags this exact line under its template-injection rule. Pass untrusted input through env: variables, quote it as "$VAR", and treat AI-generated workflow commits as untrusted code requiring the same review as any external contribution.