AI Assistants Unintentionally Introduce Workflow Injection Vulnerabilities, Automated Agents Rapidly Surface Them

A critical GitHub Actions workflow vulnerability was recently discovered in one of Snowflake’s public repositories. The issue allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner by opening a specially crafted issue title. This incident highlights the rapidly emerging reality that AI coding assistants can inadvertently introduce workflow injection vulnerabilities, and automated agents can quickly surface them in the wild.

The vulnerability was introduced on June 18, 2026, via a commit co-authored by Copilot Autofix powered by AI (PR #1218). The AI assistant removed the repository’s existing sanitized input pattern and replaced it with direct string expansion in a shell script. This change created an injection vector that could be exploited to access sensitive data.

Wiz Research’s ‘Red Agent’ - an autonomous, AI-powered security research tool - independently discovered and exploited this vulnerability as part of ongoing security research conducted through Snowflake’s HackerOne vulnerability disclosure program. The Red Agent identified the critical GitHub Actions workflow vulnerability in one of Snowflake’s public repositories without human intervention.

The incident began when Wiz Research’s ‘Red Agent’ scanned Snowflake’s GitHub organization and flagged the jira_issue.yml Workflow in snowflakedb/snowflake-connector-net as vulnerable to script injection via untrusted input in run: blocks. The workflow triggered on issues opened, interpolating the attacker-controlled issue title directly into a shell script.

The sed escaping runs after GitHub’s template expansion, but a single quote in the title breaks out of echo ’…’ and allows arbitrary command execution. This is because the AI-generated PR removed the repository’s existing safe pattern, which passed the issue title through an env: variable and built the JSON payload with jq. Instead, it used direct string interpolation.

The Open ‘Security Gate’ condition appeared protective but was actually flawed. The workflow had an if: condition that checked for a specific GitHub user, but on issues events, github.event.pull_request is always null. This means every GitHub user passes the gate and can exploit the vulnerability.

Wiz Research crafted an issue title that breaks out of the echo string and exfiltrates Jira credentials via an out-of-band callback. Initially, Red Agent’s cicd capability attempted exfiltration using a standard comment character (#), but this caused a bash syntax error because it consumed the closing parenthetical of TITLE=$(…).

Rather than stopping or failing, Red Agent autonomously analyzed the syntax execution error and adjusted its payload to use ; echo ’ to properly close the shell block. Within seconds, our listener received the callback from a GitHub Actions runner (Azure IP 20.106.182.197) containing base64-encoded credentials.

The exfiltrated token authenticated as [email protected] to snowflakecomputing.atlassian.net, granting read access across Snowflake’s engineering, security compliance, and bug bounty tracking projects. This incident highlights the importance of rigorous oversight when using AI code generation tools.

Snowflake patched the workflow on June 23, 2026 (1dc7766, PR #1402), fully restoring the safe env: variable and jq —arg parsing pattern. The JIRA token in question was revoked and rotated. Comprehensive audit log analysis confirmed that no external third parties accessed the endpoint during the 5-day exposure window.

The vulnerability was live for only five days before an automated agent discovered and validated it, requiring rapid patch cycles and short-lived credentials. This incident emphasizes the need to adapt security operations to a landscape where automated discovery occurs in hours.

Automated AI assistants often lack historical context regarding why specific code patterns were chosen. In this case, an automated PR removed a safe env: + jq parsing pattern that had been explicitly implemented to prevent shell injection. Security teams must implement guardrails that block AI agents from replacing structured data parsers with direct string interpolation.

The disclosure timeline is as follows: June 18, 2026 - Script-injection pattern introduced in jira_issue.yml by commit 4a1b8ce (PR #1218), co-authored by Copilot Autofix powered by AI; June 23, 2026 - Wiz identified, exploited, and reported vulnerability to Snowflake via HackerOne (report #3819931); June 23, 2026 - Slack notification sent to Snowflake security team.

Snowflake appreciates Wiz’s responsible reporting of and collaboration around these findings through our vulnerability disclosure and bug bounty program. Protecting our systems remains a top priority, and we remain committed to continually strengthening our software development and security practices.