Wiz AI Agent Finds Snowflake GitHub Actions Flaw

An autonomous AI security agent from Wiz found and exploited a Snowflake GitHub Actions flaw that exposed a credential for an internal Jira system.

The vulnerability allowed unauthenticated users to run commands by submitting a GitHub issue with a specially crafted title. Snowflake fixed the issue and rotated the affected credential after Wiz reported it.

Snowflake GitHub Actions flaw exposed internal token

The issue affected Snowflake’s public snowflake-connector-net GitHub repository.

A vulnerable workflow processed GitHub issue titles unsafely inside a shell script. Whenever a user created an issue, the automation ran automatically. An attacker could exploit that process to execute commands within the workflow environment.

Wiz said its autonomous Red Agent identified the flaw five days after the vulnerable code went live. The agent then demonstrated that it could extract a token linked to Snowflake’s internal Jira environment.

That token could potentially have enabled further access to sensitive internal systems. However, Snowflake said its investigation found no evidence that unauthorised parties accessed its systems.

AI tools and security checks missed the issue

The vulnerable code entered the repository through a pull request originally submitted in August 2025.

According to Wiz, the pull request involved AI-assisted coding and received input from GitHub’s security tools. GitHub Advanced Security scanned the final code, while a human reviewer ultimately approved and merged it.

However, none of those checks identified the critical command injection risk.

The issue reportedly appeared after developers replaced a safer data-handling method with direct interpolation of the issue title in a shell command. This kind of pattern can turn untrusted user input into executable code.

Wiz said the case shows how AI coding assistants can introduce insecure coding patterns that automated reviews and conventional security scans may fail to catch.

Autonomous AI found and tested the bug

Wiz’s AI agent did not simply flag the issue. The company said it independently identified the vulnerable workflow, tested the flaw and confirmed that it could access sensitive data with the exposed token.

The agent reportedly adjusted its approach after an initial attempt failed, then reassessed the potential impact. Wiz disclosed the issue to Snowflake on June 23, the same day it confirmed the vulnerability.

Snowflake patched the flaw and replaced the affected Jira credential. The company said it continues to strengthen its software development and security practices.

AI development needs stronger security controls

The Snowflake GitHub Actions flaw highlights a growing challenge for software teams. AI coding tools can speed up development, but they may also generate outdated or unsafe code patterns.

Security teams should treat AI-generated code with the same caution as code written manually. That includes reviewing workflows that handle user-controlled data, checking shell scripts for unsafe input handling and testing automated processes before deployment.

The case also shows how quickly autonomous security tools can identify vulnerabilities. Defenders may need to prepare for threats that move from discovery to exploitation in hours rather than days.