An autonomous AI security agent built by Wiz Research has demonstrated how quickly a single overlooked line of shell code can cascade into a full credential leak.

The tool, known as Wiz Red Agent, independently discovered, exploited, and validated a critical GitHub Actions injection flaw in Snowflake’s public repository, snowflake-connector-net, ultimately gaining read access to Snowflake’s internal Jira instance without any human steering the attack.

The vulnerability lived inside a workflow file called jira_issue.yml, which was designed to automatically create Jira tickets whenever someone opened a GitHub issue.

The flaw traces back to pull request #1218, merged on June 18, 2026, which replaced a previously safe pattern using environment variables and jq parsing with direct interpolation of the untrusted issue title into a shell script.

AI Agent Hacks Snowflake GitHub Workflow

Because GitHub’s template expansion happens before shell escaping runs, a single quote in the issue title was enough to break out of the script and inject arbitrary commands. Making matters worse, a conditional check that was supposed to gate access always evaluated to true on issue-opened events, meaning any GitHub user could trigger the exploit.

Notably, GitHub Advanced Security scanned the exact revision containing the vulnerable code and failed to flag it, even though a Copilot-assisted change touched a related file, jira_close.yml, in the same pull request.

Wiz later clarified that Copilot’s documented contribution was limited to that separate file and that it reviewed the merged PR without catching the critical flaw.

Red Agent found the weakness just five days after it went live, on June 23, 2026. It crafted a malicious issue title that used a base64-encoded, out-of-band callback to exfiltrate Jira credentials from the GitHub Actions runner.

When its first payload attempt using a comment character broke the shell syntax, the agent autonomously diagnosed the bash error and rewrote the payload to properly close the script, succeeding on its second attempt.

Within seconds, Wiz’s listener received a callback from an Azure-hosted runner containing base64-encoded Jira API tokens, tied to a service account, qa@snowflake.net.

That token authenticated successfully with Snowflake’s Atlassian instance, granting visibility into engineering, security compliance, and bug-bounty tracking projects a serious blast radius for a single misconfigured CI workflow.

Snowflake responded the same day the flaw was reported through HackerOne, patching the workflow, rotating the exposed Jira token, and confirming through audit logs that Wiz’s testing traffic was the only activity during the exposure window. All data accessed during proof-of-concept testing was deleted.

The incident underscores a growing concern in software security: AI-assisted coding can just as easily reintroduce insecure patterns as it can catch them, and existing static analysis tools may not keep pace.

It also signals a shift in the threat landscape itself, where autonomous AI agents can compress discovery-to-exploitation timelines from weeks to hours.

For security teams, the takeaway is clear: CI/CD pipelines need explicit enforcement of safe coding patterns, short-lived credentials, and scrutiny of AI-generated code that matches, not lags behind, the speed at which both attackers and defenders are now automating their work.

Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post AI Agent Hacks Snowflake GitHub Workflow and Reaches Internal Jira appeared first on Cyber Security News.