Coding assistants

Wiz Research's Red Agent, an autonomous AI-powered security research tool, found a script injection vulnerability in snowflakedb/snowflake-connector-net through Snowflake's HackerOne program. The jira_issue.yml GitHub Actions workflow, triggered by issues opened, interpolated the attacker-controlled issue title into a shell script, letting any GitHub user run arbitrary commands on a runner by opening a crafted issue. The flaw was introduced on June 18, 2026 by PR #1218, co-authored by Copilot Autofix, and Wiz disclosed it on June 23, 2026.

Norwegian AI researcher Håkon Måløy reported that an attacker can hide instructions in a Word document that Copilot later uses as source material, so the malicious instructions can alter figures in the newly generated document and copy themselves into it. Microsoft confirmed the report and said it addressed the findings, but Måløy said the core vulnerability had not yet been fixed when he published.

Norwegian AI researcher Håkon Måløy published details of an AI worm that spreads through Microsoft Word and Copilot. An attacker can hide instructions in a document used as source material for Copilot-generated or Copilot-edited Word documents, where they can alter figures and copy themselves into new documents that carry the attack into other Copilot-assisted workflows. Microsoft confirmed the findings and said it has addressed them.

Håkon Måløy disclosed a technique in which hidden instructions in a Word document make Microsoft 365 Copilot halve financial figures in a report and copy the same instructions, in white eight-point text, into the finished file. The chain spreads only through further Copilot drafting or editing operations, and the disclosure reports no exploitation in the wild and no public CVE. Måløy says the attack class still reproduced on July 28, after Microsoft deployed two mitigations.

CVE-2026-13009 affects the AI Copilot – Content Generator WordPress plugin in all versions up to and including 1.5.4. Insufficient escaping of the order[0][dir] parameter and a lack of prepared statements allow authenticated attackers with subscriber-level access or higher to append SQL queries to existing ones and extract sensitive database information. The waic-nonce is exposed on the front-end when the [waic_form] or [aiwu-form] shortcode renders, so contributor-level users who can publish shortcodes can obtain it and reach the vulnerable AJAX handler, which checks only the nonce when the shortcodes are not already embedded in a page.

CVE-2026-55145 is a command injection flaw (CWE-77) in Outlook Copilot, caused by improper neutralization of special elements used in a command. The source says an authorized attacker can perform tampering over a network. NVD had not yet provided an assessment at the time of publication on 07/14/2026.