Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Due to an AI-Generated GitHub Copilot “Autofix”

A security researcher's AI tool (Wiz Red Agent) found a critical vulnerability in Snowflake's GitHub workflow that allowed attackers to run arbitrary commands by opening a GitHub issue with a specially crafted title. The vulnerability was accidentally introduced five days earlier when GitHub Copilot's autofix feature removed safe input sanitization (a protective pattern using environment variables and jq, a JSON processor) and replaced it with direct string expansion, creating a script injection vulnerability (a flaw where untrusted input is directly inserted into executable code).