A GitHub Actions workflow in Snowflake’s public repository had a critical injection flaw: it interpolated untrusted input (GitHub issue titles) directly into shell commands without escaping. A single quote in an issue title breaks context and injects code. The exploit exfiltrated Jira credentials including an API token and internal project URLs.
What’s interesting is the path to the bug. PR #1218 had refactored the workflow to replace a safer approach using environment variables and jq with direct string interpolation. It was an explicit step toward less security, not more. The vulnerable workflow merged five days later.
Wiz’s Red Agent discovered it on June 23, 2026. Snowflake patched the same day. An autonomous AI agent found what GitHub Copilot (which may have been involved in the vulnerable refactoring) did not. The gap in AI-assisted security review is worth examining.
Sources: Red Agent Exploits Snowflake Vuln Missed by Github Copilot
Coverage: Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection • GitHub Copilot Missed a Vulnerability That Wiz’s AI Agent Found
Related on this blog: 54 Fake CVEs in Four Days, and Nobody Checked • One Word Beat GitHub’s Guardrail, and the Word Was ‘Additionally’ • Google Patched Its Agent-to-Agent Privilege Bug, Then Declined to Pay for It