An AI coding assistant introduced a critical script injection vulnerability into the snowflakedb/snowflake-connector-net repository on June 18, 2026, which was subsequently discovered and autonomously exploited by an AI-powered offensive security agent from Wiz on June 23, resulting in temporary credential exposure before a rapid patch.
The Anatomy of an AI-Generated Supply Chain Flaw
Software development workflows are facing a novel class of supply chain risk where generative code tools not only accelerate output but also author critical logic errors. On June 18, GitHub Copilot Autofix co-authored a commit for the snowflakedb/snowflake-connector-net repository. According to security findings detailed by Wiz, the AI assistant removed the repository’s existing sanitized input pattern in run blocks and replaced it with direct string expansion inside a shell script.
This subtle algorithmic shift introduced a classic script injection vector. Developers increasingly rely on automated remediation tools to close technical debt, yet this incident demonstrates how machine-generated code can bypass human mental models during pull-request reviews. The pipeline optimization that saved minutes during authoring created an opening that required an equally automated attacker to uncover.
Autonomous Exploitation in the Wild
Five days after the commit landed in the public repository, Wiz deployed its red agent—an AI-powered autonomous attacker designed for offensive security operations—during a routine scan on June 23. The autonomous agent located the GitHub Actions workflow flaw immediately. By crafting an issue title that broke out of the echo string during template expansion, the agent successfully executed arbitrary commands within a GitHub Actions runner without any human intervention.
The attack went beyond simple code execution. The exploit exfiltrated Jira credentials via an out-of-band callback. These exposed tokens gave Wiz read access to internal engineering, security compliance, and bug bounty tracking projects at Snowflake. Gal Nagli, head of threat exposure at Wiz, noted that the incident highlights how automated AI agents can rapidly surface vulnerabilities in the wild that slip past traditional developer oversight.
Rapid Remediation and Audit Logs
Speed is everything when dealing with autonomous attack vectors. Snowflake moved with urgency once the vulnerability was reported through its HackerOne bug bounty program on June 23. The cloud data platform patched the workflow flaw the exact same day.
Operations continued with credential rotation on June 24. Snowflake revoked and rotated the compromised Jira token and examined internal audit logs to reconstruct the exposure window. According to a Snowflake spokesperson, the investigation confirmed that Wiz was the sole third-party entity to access the endpoint during the five-day exposure window, and audit logs showed no evidence of unauthorized access outside the sanctioned test. Wiz confirmed that all data accessed during its proof-of-concept testing was securely deleted.
Implications for Enterprise Software Pipelines
The intersection of AI-authored code and AI-driven exploitation marks a definitive shift in application security. Traditional code reviews, while vital, struggle to keep pace with the velocity of automated generation and the complex syntax bugs introduced by large language models. Engineering teams must reevaluate their continuous integration and continuous deployment pipelines to handle automated threats.
- Automated Introduction: GitHub Copilot Autofix co-authored the commit on June 18, replacing input sanitization with direct string expansion.
- Autonomous Detection: Wiz’s offensive AI agent flagged and exploited the vulnerability during a routine public repository scan on June 23.
- Immediate Patching: Snowflake remediated the vulnerability the same day it was reported and rotated credentials within 24 hours.
As development organizations lean further into automated workflows, securing the software supply chain requires treating AI coding assistants and automated attack agents as active participants in the threat landscape. Code review practices must evolve to match the speed of the machines writing and testing the software.
