LIVE FEED
HIGH Shostack's LLM Threat Model Responds to Hugging Face Attack // HIGH Naming Error Lets Anthropic AI Models Attack Real Company // HIGH Israel-Linked Fake Think Tank Targets LLM Training Data // CRITICAL GitHub Copilot Autofix Introduced CI/CD Injection in Snowflake // CRITICAL Claude Agents Create Self-Replicating Malware in Turf War // FIRST LOOK Anthropic MCP Server Security Risks and Secrets Exposure Explained // HIGH OpenAI Disbands Preparedness Team Amid IPO Safety Concerns // FIRST LOOK AWS AgentCore Observability Brings Multi-Cloud AI Agent Monitoring // FIRST LOOK OpenAI Astra Launches with Critical-Level Cyber Evaluation Controls // HIGH Kimsuky Runs Offline LLMs to Sharpen Phishing, Build Malware //
ATLAS OWASP CRITICAL Active exploitation · Immediate action required Agentic AI Supply Chain LLM Security Research RELEVANCE ▲ 9.2

GitHub Copilot Autofix Introduced CI/CD Injection in Snowflake

SOURCE HN AI Security ↗
TL;DR CRITICAL
  • What happened: Copilot Autofix introduced a shell injection flaw that exposed Snowflake's internal Jira via a stolen token.
  • Who's at risk: Any organisation using AI-assisted code review and GitHub Actions workflows triggered by untrusted user input is directly exposed to similar injection attacks.
  • Act now: Audit all GitHub Actions workflows for direct ${{ github.event }} interpolation inside run: blocks · Never trust AI-generated or AI-reviewed code commits without a human security review for injection-prone contexts · Enforce least-privilege secrets scoping so workflow tokens cannot access internal systems like Jira
GitHub Copilot Autofix Introduced CI/CD Injection in Snowflake

Overview

On June 23, 2026, Wiz Research disclosed a critical GitHub Actions script injection vulnerability in Snowflake’s public snowflakedb/snowflake-connector-net repository. The flaw was independently discovered and exploited by Wiz’s autonomous “Red Agent” — an AI-powered offensive security tool — just five days after the vulnerable code was merged. What makes this incident particularly significant is its origin: the vulnerable pattern was introduced by a commit co-authored by GitHub Copilot Autofix, and the same AI-assisted review process failed to flag the resulting critical vulnerability. Snowflake remediated the issue on the day of disclosure and confirmed via audit logs that Wiz was the sole actor during the exposure window.

Technical Analysis

The vulnerability resided in jira_issue.yml, a workflow triggered whenever any GitHub user opened an issue on the repository. A prior safe implementation passed the issue title through an env: variable and constructed the JSON payload using jq, preventing shell injection:

env:
  ISSUE_TITLE: ${{ github.event.issue.title }}
run: jq -n --arg title "$ISSUE_TITLE" ...

The Copilot Autofix co-authored commit (PR #1218, June 18 2026) replaced this pattern with direct GitHub expression interpolation inside a run: block, relying on sed for escaping:

run: |
  TITLE=$(echo '${{ github.event.issue.title }}' | sed 's/"/\\"/g' | sed "s/'/\\\'/g")

The critical flaw: GitHub’s template engine expands ${{ github.event.issue.title }} before the shell executes, so the sed escaping never processes attacker-controlled input at the right stage. A single quote in the issue title terminates the echo '...' argument and allows arbitrary command injection. An attacker simply opens a GitHub issue with a crafted title to achieve remote code execution on the Actions runner — no authentication required.

Wiz Red Agent exploited this to exfiltrate a secret token present in the runner environment, which granted access to Snowflake’s internal Jira portal.

Framework Mapping

  • AML.T0047 (AI-Enabled Product or Service): GitHub Copilot Autofix, an AI product, directly introduced the vulnerability through a code suggestion merged without adequate human security review.
  • AML.T0010 (AI Supply Chain Compromise): The compromised code change entered the supply chain via an AI co-authored PR, affecting downstream CI/CD security posture.
  • AML.T0086 / AML.T0083: Red Agent exfiltrated credentials via automated tool invocation and leveraged them for lateral access.
  • LLM09 (Overreliance): Developers and reviewers trusted Copilot’s output and review without independent security validation.
  • LLM05 (Supply Chain Vulnerabilities): The AI-assisted PR introduced a security regression into a public, widely-used repository.

Impact Assessment

The blast radius included access to Snowflake’s internal Jira instance via an exfiltrated token. Snowflake confirmed that no data was retained by Wiz and that no other actor accessed the system during the exposure window. However, the vulnerability was publicly exploitable for five days — any threat actor scanning GitHub Actions workflows for injection patterns could have discovered and exploited it independently.

The broader industry implication is severe: AI coding assistants can introduce subtle, high-severity vulnerabilities while simultaneously providing a false sense of security through AI-powered review.

Mitigation & Recommendations

  1. Ban direct expression interpolation in run: blocks. Always pass untrusted GitHub event data through env: variables; never embed ${{ }} expressions directly in shell scripts.
  2. Implement SAST rules for Actions injection patterns. Tools like zizmor or Semgrep Actions packs can detect these patterns in CI.
  3. Require human security review for AI-generated commits touching CI/CD workflow files, especially those modifying input handling.
  4. Scope workflow secrets tightly. Tokens available to issue-triggered workflows should have minimal permissions — never access to internal systems like Jira.
  5. Run autonomous red-team scanning against your own GitHub organisation to detect injection-vulnerable workflows proactively.

References

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.