An autonomous AI agent successfully exploited a script injection vulnerability in a Snowflake GitHub repository, which had been inadvertently introduced by an AI coding assistant just five days prior. The incident, part of a sanctioned bug bounty program, saw an AI-powered "red agent" from Wiz discover and exploit the flaw, leading to the exfiltration of credentials without human intervention.
The vulnerability was found in the `snowflakedb/snowflake-connector-net` repository's GitHub Actions workflow. Specifically, a script injection flaw in `run:` blocks allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner. This was achievable by opening a GitHub issue with a specially crafted title that, after template expansion, could break out of an `echo` string.
The root cause of the vulnerability was a commit made on June 18, co-authored by GitHub Copilot Autofix, an AI coding assistant. The AI assistant removed an existing sanitized input pattern and replaced it with direct string expansion in a shell script, thereby introducing the script injection bug.
Wiz's red agent, designed for offensive security, identified this flaw during a routine scan of public repositories on June 23. The agent then crafted an issue title to exploit the vulnerability, successfully exfiltrating Jira credentials via an out-of-band callback. These credentials provided Wiz with read access to Snowflake's engineering, security compliance, and bug bounty tracking projects.
Wiz reported the workflow vulnerability to Snowflake on June 23, the same day it was discovered. Snowflake promptly patched the flaw and revoked and rotated the affected Jira token. An internal audit confirmed that Wiz was the only third party to access the endpoint during the five-day exposure window. Snowflake stated that its investigation found no evidence of unauthorized access.
Following the disclosure, Wiz deleted all data accessed during its vulnerability research and proof-of-concept exploit testing. The company highlighted the incident as evidence that traditional human code review processes may not be sufficient to rapidly detect vulnerabilities, especially as developers increasingly integrate AI coding assistants into their workflows. The event underscores the emerging challenge of AI-introduced vulnerabilities and the potential for automated AI agents to quickly discover and exploit them.
