AI-Generated Bug in Snowflake Workflow Exploited by Autonomous AI Agent

A cycle of automated AI creation and destruction recently left Snowflake's internal project data exposed after one AI tool introduced a security flaw that another AI autonomously exploited. The incident highlights a new frontier in cybersecurity where the speed of the attack-defense cycle is driven by agentic AI rather than human operators.

On June 18, 2026, a script injection vulnerability was introduced into the 'snowflakedb/snowflake-connector-net' repository via PR #1218. The change was co-authored by 'Copilot Autofix powered by AI,' which replaced a secure pattern using 'env:' and 'jq' with direct string interpolation of GitHub issue titles in the 'jira_issue.yml' workflow. Five days later, on June 23, Wiz's 'Red Agent'—an autonomous AI security tool—discovered the flaw during a routine scan. The agent exploited the bug by crafting a specific issue title to exfiltrate a Jira token associated with [email protected], granting the AI read access to Snowflake's engineering, security compliance, and bug bounty tracking projects.

The AI Loop

This breach occurred within the framework of Snowflake's HackerOne vulnerability disclosure program. The technical failure centered on the GitHub Actions 'run' blocks, where the AI assistant's attempt to simplify code inadvertently removed the sanitization required to prevent command injection. Because the AI replaced a safe input pattern with direct string expansion, any user capable of creating a GitHub issue could potentially execute arbitrary code within the workflow's environment.

Industry Implications

According to Gal Nagli, Wiz's head of threat exposure, the incident demonstrates how AI coding assistants can inadvertently introduce workflow injection vulnerabilities and how automated agents can rapidly surface them in the wild. The case serves as a critical warning that traditional human code review may be insufficient to catch subtle, AI-generated flaws that are logically sound but security-deficient. It underscores a shift toward an 'AI loop' in software development, where the tools used to accelerate productivity simultaneously create new, machine-readable attack vectors.

Remediation and Outlook

Snowflake responded immediately upon receiving the report via HackerOne on June 23, patching the vulnerability and rotating the compromised credentials on the same day. While the flaw was closed quickly, the event signals a growing necessity for AI-specific security auditing. Organizations must now consider not only how AI can help find bugs but how the deployment of AI-generated patches might introduce systemic risks that autonomous attackers are already equipped to find.