Cybersecurity

Wiz's AI Agent Hacked Snowflake, Then Blamed Copilot

Wiz's autonomous Red Agent exploited a five-day-old flaw in Snowflake's GitHub Actions setup, then blamed Copilot for writing it. GitHub's commit log says otherwise.

CybersecurityBy Servola Tech Desk2026-08-194 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Wiz's AI Agent Hacked Snowflake, Then Blamed Copilot

Key takeaways

Wiz's own AI security agent broke into Snowflake's internal Jira through a bug that sat live for five days in June 2026, and when Wiz blamed GitHub Copilot for writing it, GitHub's commit history proved otherwise - so the only referee in an AI-on-AI dispute is your own git log.
Wiz's Red Agent needed no human to adjust its attack: after its first payload returned a syntax error, it rewrote the crafted GitHub issue title on its own and successfully exfiltrated a Jira access token within the same session.
The flaw was live in Snowflake's public snowflake-connector-net repository for five days, from the June 18, 2026 merge of PR #1218 to the June 23, 2026 patch, before Snowflake revoked and rotated the exposed token.
Wiz's original write-up named GitHub Copilot Autofix as a co-author of the vulnerable code; GitHub's internal review instead traces the unsafe refactor to a human Snowflake engineer's commit from August 25, 2025, and says Copilot's actual commit in that pull request touched an unrelated file.
Two AI vendors publicly disagreed about which one produced a security flaw, and the only evidence either side could point to was git commit history - a preview of the liability disputes coming for any company running AI coding tools and AI security scanners together.

What Wiz's Agent Actually Broke Into

Wiz built an autonomous AI agent it calls Red Agent to hunt for exploitable bugs the way a human penetration tester would, then act on what it finds. Pointed at Snowflake's public GitHub repositories, it found a script injection flaw in a GitHub Actions workflow file named jira_issue.yml inside snowflakedb/snowflake-connector-net, Snowflake's open-source .NET connector. The bug let anyone open a GitHub issue with a specially crafted title and have Snowflake's own automation execute part of that title as a shell command, no login required.

Red Agent's first attempt failed. The runner returned a syntax error instead of executing the payload. Rather than stopping there, the agent read the error, rewrote the crafted issue title on its own, and tried again. The second attempt broke out of the shell string and reached an attacker-controlled domain, exfiltrating a base64-encoded Jira API token in the process. Discovery, adjustment, exploitation, and verification of the resulting access all happened in one session, with no human choosing the next step.

The stolen token was valid and authenticated as a Snowflake service account, granting read access to an internal Jira instance covering engineering, security compliance, and bug bounty tracking projects. The vulnerable code had been live since PR #1218 merged on June 18, 2026, replacing a safe parsing pattern with direct variable interpolation into a shell command. Snowflake patched it on June 23, 2026, restoring the safe pattern, and revoked and rotated the exposed token; an audit of the logs found no external party had used it during the five-day exposure window.

Wiz Named Copilot As Co-Author Of The Bug

Wiz's original write-up pointed to the commit that introduced the flaw and noted that GitHub Copilot Autofix appeared as a co-author on it. The framing wrote itself: an AI coding assistant had helped write the exact bug that an AI security agent then found and exploited, autonomously, on both ends.

The co-author line was real, and squash merges make that kind of evidence look more solid than it is. A pull request can contain many individual commits from many contributors, but a squash merge folds all of them into a single commit on the main branch, and every co-author trailer from every one of those commits rides along into the merged result. A name on that trailer records participation somewhere in the pull request, not authorship of any specific line. By the time Wiz updated its post on August 17, 2026, its own language had softened to acknowledging it was unclear whether Copilot had assisted in writing the vulnerable lines at all.

GitHub's Commit History Says A Human Wrote It

GitHub ran its own internal review of the same repository and reached a different conclusion. It says a human Snowflake engineer authored the unsafe refactor, in a separate commit dated August 25, 2025, roughly ten months before the vulnerable pull request was merged, and that Copilot Autofix neither reviewed nor contributed to those specific lines.

Copilot's actual co-authored commit inside pull request #1218 changed a different file, jira_close.yml, unrelated to the vulnerable jira_issue.yml lines that Red Agent exploited. When the pull request was squashed into one merge commit, Copilot's co-author trailer traveled with it anyway, attached to a change it never touched.

The dispute now sits in public with two incompatible accounts and no independent referee. Wiz points to a co-author trailer on the live commit history; GitHub points to an internal review of the same repository that reads the authorship differently. Nobody outside the two companies has the access needed to settle which reading is correct.

The Governance Gap Every AI-Assisted Team Should Notice

Running an AI coding assistant and an AI security scanner in the same pipeline is fast becoming the default setup, not the exception. When something breaks under that setup, the party that finds the bug and the tool accused of writing it can both be AI systems, and the only account either side can point to is a repository's own commit history. That history is only as trustworthy as the practices that produced it, and a routine squash merge just proved it can attach one contributor's name to another contributor's mistake without anyone intending it.

The bug itself took five days to sit exposed and five more to patch. The argument over who wrote it ran longer than the vulnerability did, and it happened between two vendors with the resources and repository access to investigate it properly. A company with less discipline about preserving commit history on its own workflow files, and no standing answer for who is authorized to publish an attribution claim before it becomes a public dispute, will not resolve its version this cleanly.

Frequently asked questions

Did GitHub Copilot write the vulnerable code Wiz's agent exploited?

That is disputed. Wiz's original write-up named GitHub Copilot Autofix as a co-author of the commit that introduced the flaw. GitHub's internal review attributes the unsafe refactor to a human Snowflake engineer's commit from August 25, 2025, and says Copilot's actual co-authored commit in that pull request touched an unrelated file. The public dispute remains unresolved.

What did Wiz's AI agent actually access inside Snowflake?

It exfiltrated a Jira API token and used it to confirm read access to an internal Snowflake Jira instance covering engineering, security compliance, and bug bounty tracking projects. The exposure window ran from June 18 to June 23, 2026; Snowflake revoked and rotated the token and found no evidence any external party used it.

What should a company do if it runs both AI coding tools and AI security scanners?

Preserve unsquashed, granular commit history on CI/CD and workflow files specifically, since that is the only record that can settle an authorship dispute after the fact. Treat any AI tool's self-reported authorship or attribution claim as unverified until checked against the underlying commits, and decide in advance who inside the company is authorized to publish an attribution claim before one becomes a public dispute between vendors.

The vulnerability got patched in five days and nobody outside Snowflake and Wiz was harmed by it. The argument over who wrote it took longer to settle than the bug itself, fought between two vendors who had the access and the resources to investigate their own repository properly. Most companies running an AI coding assistant next to an AI security scanner do not have that access to someone else's audit trail; they only have their own, and this is the moment to check what it actually preserves.

WizGitHub CopilotSnowflakeAI SecuritySoftware Supply Chain

Machine Identities Now Outnumber Employees by 80 to 1

Machine identities now outnumber employees by as much as 80 to 1, and most are ungoverned. Why your AI agents are your fastest-growing security risk.

2 min read

Cybersecurity

Six Days, Three Critical Flaws, Zero Grace Period

Ray, GitLab and Apple all disclosed critical, unauthenticated remote-exploit flaws in six days in August 2026, each mass-exploited within days of a patch.

3 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.

4 min read

← All articles