Security researchers at Wiz found a script injection flaw in a Snowflake GitHub Actions workflow that let an unauthenticated attacker run arbitrary commands, the company said in a blog post. The attacker could trigger the flaw by crafting a specially formatted GitHub issue title, according to the post.
GitHub Copilot's Autofix feature had reviewed the pull request that introduced the flaw and listed itself as a co-author, but "identified it as all-clear without noticing the critical vulnerabilities," Wiz said. The company's own automated security scanning also missed the risk despite analyzing the final workflow, according to the post.
Wiz's Red Agent used the flaw to extract credentials for Snowflake's internal Jira instance, gaining read access to engineering, security compliance and bug bounty tracking projects, the company said. The vulnerable code merged on June 18, and Wiz reported it to Snowflake on June 23, the same day Snowflake patched it and rotated the exposed Jira token, according to the post.
Snowflake said it "immediately investigated and remediated" the issue and found no evidence of unauthorized access beyond Wiz's own test, according to the post.
The case is a warning about trusting AI code review as a security gate rather than a first pass. Copilot's Autofix cleared the exact change that later let researchers walk into a live production system, which argues for keeping a second reviewer, human or automated, on anything that touches shell escaping or command execution.