Wiz Research’s autonomous AI tool, called Red Agent, found and validated a critical script-injection vulnerability in one of Snowflake’s public GitHub repositories that GitHub’s own Advanced Security scanning had missed, according to Wiz’s August 17 writeup of the find.
What happened
The flaw sat in a GitHub Actions workflow file in the snowflakedb/snowflake-connector-net repository. An attacker could trigger it without authentication by opening a GitHub issue with a specially crafted title, because the workflow passed untrusted issue text into a shell execution step. Wiz’s agent identified the weakness, then confirmed it could reach a Jira API token scoped to Snowflake’s engineering, security compliance, and bug bounty tracking projects. Wiz reported the issue to Snowflake through HackerOne on June 23, and Snowflake patched the workflow and rotated the exposed token the same day.
Why it matters
The vulnerable code had GitHub Copilot Autofix listed as a co-author on the pull request that introduced it, which is why this case has become a reference point for AI-assisted code review’s limits: a tool built to catch this class of bug missed it, and a different AI tool found it weeks later. The lesson is not to distrust AI code review outright but to keep human and automated review focused on CI/CD workflow files, which get far less scrutiny than application code despite routinely holding tokens with broad access.
The original insight
What makes this case notable for defenders is less the bug itself, a common script-injection pattern in GitHub Actions, and more that it was found by an autonomous research agent working without a human directing each step, the same category of tool CyberTech covered when CrowdStrike launched a challenge to test defenses against agentic AI threats. Offense-side AI agents finding real CI/CD bugs faster than static scanners is a preview of the tooling security teams should expect on the defensive side too, and an autonomous agent already ran an actual intrusion at Hugging Face earlier this year, so the capability gap between automated attack and automated defense is the thing to watch, not any single CVE.
Source: Wiz Research
