Was Snowflake customer data exposed?

Snowflake says its investigation found no evidence of unauthorized access. The stolen token authenticated to Snowflake's internal Jira and gave read access to engineering, security compliance and bug bounty projects, not to customer data in the Snowflake platform. Audit logs showed Wiz was the only third party that reached the endpoint during the five-day window.

How long was the Snowflake workflow exploitable?

The vulnerable workflow was exploitable for five days. Copilot Autofix introduced the flaw on June 18, 2026 in PR #1218, and Wiz reported it on June 23, 2026. Snowflake merged the patch in PR #1402 the same day it was reported and rotated the exposed Jira credential the following day, June 24.

Does this mean GitHub Copilot Autofix should not be trusted?

The Wiz write-up documents one Copilot Autofix suggestion, not a systemic failure rate. Worth noting: the change was co-authored by the Copilot Autofix bot but reviewed and merged by a Snowflake engineer in PR #1218, so a human approved it. The practical lesson is to review AI-suggested changes to CI workflows as closely as any other code that touches secrets.

Was this authorized security testing or an actual attack?

The Wiz Red Agent research ran through Snowflake's HackerOne bug bounty program, which makes it sanctioned testing rather than an unsolicited intrusion. Wiz disclosed the flaw to Snowflake on June 23, 2026, waited for the patch and credential rotation, and published the technical write-up on August 17, 2026.

Wiz · 2026-08-17 · major

Wiz Red Agent breaks into Snowflake's Jira — via a bug Copilot Autofix wrote

Wiz Red Agent, an autonomous AI security tester, found and exploited a command-injection bug that GitHub Copilot Autofix had written into a Snowflake repository's GitHub Actions workflow, then read Snowflake's internal Jira.

Wiz report on an autonomous AI agent exploiting a Copilot-written flaw in Snowflake's CI

One AI wrote the security hole. Another AI found and exploited it five days later.

Quick facts

Found by	Wiz Red Agent (autonomous AI)
Affected repo	snowflakedb/snowflake-connector-net
Bug introduced	June 18, 2026 (PR #1218)
Reported and patched	June 23, 2026 (PR #1402)
Exposure window	5 days
Access gained	Read access to Snowflake's internal Jira
Authorization	Snowflake HackerOne bug bounty

What is it?

Wiz Red Agent, an autonomous AI penetration tester, opened a GitHub issue on a public Snowflake repository and used the issue title to run its own shell commands on the project's CI runner. The flaw it abused had been written by GitHub Copilot Autofix, which replaced the repository's existing safe input handling with direct string interpolation inside a workflow script. Wiz published the full account on August 17, 2026.

How does it work?

The affected workflow in snowflakedb/snowflake-connector-net ran on every new GitHub issue and pasted the issue title straight into a shell script. Escaping with sed happened after GitHub had already expanded the template, so a single quote in a title broke out of the string and ran arbitrary commands. Red Agent's first payload died on a bash syntax error; the agent read the failure, rewrote the payload, and sent the workflow's Jira credentials to an out-of-band listener as base64.

Why does it matter?

Copilot Autofix exists to close security holes, so a suggested fix that opens one changes how carefully teams should read AI-written patches — especially patches touching CI files that hold secrets. The Snowflake case also shows the other side: autonomous attack agents can now discover and chain this class of mistake within days of the commit landing.

Who is it for?

security engineers and CI/CD maintainers

Frequently asked questions

Was Snowflake customer data exposed?: Snowflake says its investigation found no evidence of unauthorized access. The stolen token authenticated to Snowflake's internal Jira and gave read access to engineering, security compliance and bug bounty projects, not to customer data in the Snowflake platform. Audit logs showed Wiz was the only third party that reached the endpoint during the five-day window.
How long was the Snowflake workflow exploitable?: The vulnerable workflow was exploitable for five days. Copilot Autofix introduced the flaw on June 18, 2026 in PR #1218, and Wiz reported it on June 23, 2026. Snowflake merged the patch in PR #1402 the same day it was reported and rotated the exposed Jira credential the following day, June 24.
Does this mean GitHub Copilot Autofix should not be trusted?: The Wiz write-up documents one Copilot Autofix suggestion, not a systemic failure rate. Worth noting: the change was co-authored by the Copilot Autofix bot but reviewed and merged by a Snowflake engineer in PR #1218, so a human approved it. The practical lesson is to review AI-suggested changes to CI workflows as closely as any other code that touches secrets.
Was this authorized security testing or an actual attack?: The Wiz Red Agent research ran through Snowflake's HackerOne bug bounty program, which makes it sanctioned testing rather than an unsolicited intrusion. Wiz disclosed the flaw to Snowflake on June 23, 2026, waited for the patch and credential rotation, and published the technical write-up on August 17, 2026.