An AI Agent Exploits a Copilot-Reviewed GitHub Actions Bug in Snowflake's Repository and Reaches Internal Jira

Snowflake's public `snowflake-connector-net` repository and, through it, Snowflake's internal Atlassian Jira instance

Wiz Research disclosed that its autonomous offensive agent, Red Agent, independently found, exploited, and validated a script injection flaw in Snowflake's `jira_issue.yml` GitHub Actions workflow, which opened a Jira ticket whenever anyone filed a GitHub issue. Pull request #1218, merged on June 18, 2026, had replaced a safe pattern using environment variables and `jq` parsing with direct interpolation of the untrusted issue title into a shell script. GitHub Copilot co-authored the review of that merge and marked it all clear without flagging the injection. Red Agent found the weakness five days later, on June 23, and crafted an issue title carrying a base64-encoded out-of-band callback. When its first payload broke the shell syntax, the agent diagnosed the bash error on its own and rewrote the payload to close the script correctly, succeeding on the second attempt. The callback returned a Jira API token belonging to the service account `qa@snowflake.net`, which authenticated against Snowflake's Atlassian instance and granted read access to engineering, security compliance, and bug tracking projects. Snowflake patched the workflow the same day and rotated the token on June 24; Wiz published on August 17 after its disclosure window

Untrusted issue-title text interpolated straight into a shell command inside a CI workflow holding a service-account token, introduced by a change an AI reviewer cleared and found by an AI attacker in five days. Both sides of the review-and-exploit loop were automated, and only one of them was correct