An AI Wrote the Security Bug. Another AI Found It Five Days Later

On 18 June 2026, a patch landed in Snowflake’s public snowflake-connector-net repository, co-authored by a tool called Copilot Autofix, GitHub’s feature that proposes fixes for security findings automatically. According to security firm Wiz, that patch replaced a safe way of handling input with raw string interpolation: it dropped the title of a GitHub issue straight into a shell command. Five days later, Wiz’s autonomous testing system, which it calls Red Agent, walked through the resulting hole.

The mechanics are worth understanding because they are so ordinary. The repository ran an automation that created a Jira ticket whenever someone opened an issue. The issue title was passed to a shell command, and the sanitising step, the part meant to strip out dangerous characters, ran after the template had already been expanded. That ordering is the whole bug. A single quote mark in the title was enough to break out of the intended string and append arbitrary commands. A second flaw compounded it: a gate that checked who had opened the pull request evaluated as true on issue events, because on those events there was no pull request at all.

Wiz’s agent got a shell syntax error on its first attempt, adjusted, and got a callback from the automation runner. What it retrieved was the Jira API token the workflow used, an account with read access to Snowflake’s engineering, security compliance and bug bounty projects. Snowflake patched the workflow the same day, rotated the token on 24 June, and says its investigation found no evidence of unauthorised access during the five-day window. GitHub has publicly disputed the framing that Copilot Autofix wrote the flaw.

Set aside who gets the blame and the story is still instructive. AI coding assistants are very good at producing code that looks correct and passes review, which is exactly the profile of change most likely to slip past a busy maintainer. The bug here is not exotic; it is the kind of ordering mistake a tired human makes on a Friday. What is new is the speed on both ends. A machine proposed it, a human approved it in seconds because it was labelled a security fix, and a machine found and exploited it within a week. The gap where a person actually reads the diff is getting thinner from both directions.

What this means for you: if you write code, the practical lesson is small and boring and worth doing anyway. Treat AI-suggested patches to build and deployment automation as higher risk than patches to normal application code, because that automation usually holds real credentials. Never put untrusted input, and an issue title from a stranger is untrusted input, directly into a shell command. If you do not write code, the takeaway is about trust labels: a change marked “security fix” gets less scrutiny than any other kind, which makes it the most attractive place to hide a mistake.

Sources

• Wiz: Red Agent exploits Snowflake vuln missed by GitHub Copilot
• The Register: An AI broke Snowflake’s code, then another AI agent exploited it
• The Hacker News: Snowflake GitHub Actions flaw lets crafted issues trigger command injection
• The Next Web: GitHub disputes Wiz’s claim that Copilot Autofix wrote the flaw