Copilot Autofix exposed Snowflake Jira credentials; AI found it in 5 days

An AI-generated security regression survived for five days before another AI found it and proved that Snowflake’s internal Jira credentials could be stolen. According to Wiz Research’s disclosure, a change co-authored by GitHub Copilot Autofix removed a safe input-handling pattern from a public Snowflake repository. It replaced that pattern with direct expansion of an attacker-controlled issue title inside a shell script. Any unauthenticated GitHub user could trigger the workflow by opening a specially crafted issue.

The flaw lived in the jira_issue.yml workflow of snowflakedb/snowflake-connector-net. PR #1218, merged on June 18, 2026, removed code that passed the issue title through an env variable and built JSON with jq --arg. The replacement inserted ${{ github.event.issue.title }} directly into a run: block. Its sed escaping happened only after GitHub expanded the template, so a single quote supplied in the title could terminate the shell string and create a command-injection path.

A condition that looked like a security gate did not narrow access. The workflow ran when an issue was opened, but the condition checked github.event.pull_request, a field that is always null for issue events. The comparison therefore evaluated as true for every user. Public input and secrets intended for an internal integration ended up in the same automation path.

Wiz Red Agent scanned Snowflake’s GitHub organization, identified the pattern, and tested whether it was exploitable. When its first payload produced a Bash syntax error, the agent analyzed the failure, changed how it closed the shell expression, and received an out-of-band callback from the GitHub Actions runner. The extracted token authenticated as qa@snowflake.net and provided read access to Snowflake Jira projects covering engineering, security compliance, and bug-bounty work. Wiz says discovery, exploitation, and blast-radius assessment occurred without human intervention.

Wiz reported the issue through Snowflake’s HackerOne program on June 23. Snowflake restored the safer env plus jq --arg design that day and rotated the Jira token on June 24. Audit logs for the five-day exposure window showed no access by an external third party; Snowflake said the anomalous queries matched Wiz’s testing IPs. Wiz also said it deleted all data accessed during the proof of concept.

The larger lesson is not simply that Copilot produced bad code. An automated fix erased a pattern that existed for a security reason, yet the change still reached a credential-bearing CI/CD workflow. AI-authored pull requests need the same static analysis and security review as human changes, while policy checks should flag replacements of structured parsers with direct string interpolation. As offensive agents compress discovery from months to hours or days, short-lived credentials and rapid rotation become core controls rather than cleanup steps.