AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake’s Jira

AI 生成的 GitHub Copilot “自动修复”功能导致 Snowflake 的 Jira 系统被攻破

As part of ongoing security research conducted through Snowflake’s HackerOne vulnerability disclosure program, Wiz Research’s “Red Agent”—an autonomous, AI-powered security research tool—identified a critical GitHub Actions workflow vulnerability in one of Snowflake’s public repositories. 作为 Snowflake HackerOne 漏洞披露计划持续安全研究的一部分，Wiz Research 的“Red Agent”（一款自主的 AI 安全研究工具）在 Snowflake 的一个公共代码仓库中发现了一个严重的 GitHub Actions 工作流漏洞。

This incident highlights a new reality in software development: Critical vulnerabilities can still be introduced and approved within workflows involving AI coding agents, while autonomous AI security agents can rapidly discover and exploit them in the wild. 这一事件凸显了软件开发领域的新现实：在涉及 AI 编码代理的工作流中，严重的漏洞仍可能被引入并获得批准；与此同时，自主的 AI 安全代理也能在野外迅速发现并利用这些漏洞。

Upon responsible disclosure on June 23, 2026 by Wiz, Snowflake remediated the vulnerability on the same day, rotated the affected credential, and verified via detailed audit logs that Wiz was the sole actor during the exposure window. Wiz confirmed that all data accessed during proof-of-concept testing was securely deleted. 在 Wiz 于 2026 年 6 月 23 日进行负责任的披露后，Snowflake 当天就修复了该漏洞，轮换了受影响的凭据，并通过详细的审计日志确认 Wiz 是漏洞暴露期间唯一的访问者。Wiz 确认在概念验证测试期间访问的所有数据均已安全删除。

August 17, 2026, 1957 UTC update: This blog has been updated to clarify that Copilot was a co-author that checked the merged PR and code change, and identified it as all-clear without noticing the critical vulnerabilities. It’s unclear whether the code-change was AI-assisted. 2026 年 8 月 17 日 19:57 UTC 更新：本博客已更新，旨在澄清 Copilot 作为共同作者检查了合并的 PR 和代码变更，并将其标记为“无异常”，但未能察觉其中的严重漏洞。目前尚不清楚该代码变更本身是否由 AI 辅助完成。

Executive Summary

执行摘要

Wiz Red Agent identified a script injection vulnerability in snowflakedb/snowflake-connector-net. The issue allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner by opening a GitHub issue with a specially crafted title. Wiz Red Agent 在 snowflakedb/snowflake-connector-net 中发现了一个脚本注入漏洞。该问题允许未经身份验证的用户通过创建一个标题经过特殊构造的 GitHub Issue，在 GitHub Actions 运行器中执行任意命令。

Crucially, the vulnerability became live on June 18, 2026 - just five days before its discovery - when PR #1218 was merged. The final squash commit credits “Copilot Autofix powered by AI” as a co-author. The merged PR replaced the repository’s sanitized input pattern with direct string expansion, yet GitHub’s AI-assisted security review did not flag the resulting critical vulnerability. 至关重要的是，该漏洞于 2026 年 6 月 18 日（即被发现前仅五天）随着 PR #1218 的合并而上线。最终的压缩提交（squash commit）将“由 AI 驱动的 Copilot Autofix”列为共同作者。合并后的 PR 将代码库中原有的输入过滤模式替换为了直接字符串扩展，然而 GitHub 的 AI 辅助安全审查并未标记由此产生的严重漏洞。

(Screenshot demonstrating access to Snowflake’s Jira portal, via an exfiltrated token) （展示通过窃取的令牌访问 Snowflake Jira 门户的截图）

Exposure Walk-Through

漏洞暴露过程详解

Discovery 发现过程

Wiz Red Agent’s CI/CD capability scanned Snowflake’s GitHub organization and flagged the jira_issue.yml Workflow in snowflakedb/snowflake-connector-net as vulnerable to script injection via untrusted input in run: blocks. Wiz Red Agent 的 CI/CD 功能扫描了 Snowflake 的 GitHub 组织，并将 snowflakedb/snowflake-connector-net 中的 jira_issue.yml 工作流标记为存在脚本注入漏洞，原因是其 run: 代码块中使用了不受信任的输入。

The Code Change 代码变更

- env:
-   ISSUE_TITLE: ${{ github.event.issue.title }}
-   run: jq -n --arg title "$ISSUE_TITLE" ...
+ run: TITLE=$(echo '${{ github.event.issue.title }}' | sed ...)

The workflow triggered on issues: opened - meaning any GitHub user could fire it by opening an issue - and interpolated the attacker-controlled issue title directly into a shell script: 该工作流在 issues: opened 时触发——这意味着任何 GitHub 用户都可以通过创建一个 Issue 来启动它——并将攻击者控制的 Issue 标题直接插入到 Shell 脚本中：

run: | TITLE=$(echo '${{ github.event.issue.title }}' | sed 's/"/\\"/g' | sed "s/'/\\\'/g")

The sed escaping runs after GitHub’s template expansion, a single quote in the title breaks out of echo '...' and allows arbitrary command execution. sed 转义是在 GitHub 模板扩展之后运行的，标题中的单引号会跳出 echo '...' 的范围，从而允许执行任意命令。

The injectable pattern was introduced just days earlier, on June 18, 2026, commit 4a1b8ce (PR #1218: “SNOW-2069227: Update jira workflows”) - co-authored by Copilot Autofix powered by AI. 这种可注入的模式是在几天前，即 2026 年 6 月 18 日的提交 4a1b8ce（PR #1218：“SNOW-2069227: Update jira workflows”）中引入的，该提交由 AI 驱动的 Copilot Autofix 共同完成。

(The commit introducing the vulnerable pattern) （引入漏洞模式的提交记录）

It removed the repository’s existing safe pattern, which passed the issue title through an env: variable and built the JSON payload with jq. Instead it used the direct ${{ github.event.issue.title }} interpolation shown above. In other words, an AI “autofix” commit created the very injection vector. 它移除了代码库中原有的安全模式（该模式通过 env: 变量传递 Issue 标题并使用 jq 构建 JSON 有效载荷），转而使用了上述直接的 ${{ github.event.issue.title }} 插值方式。换句话说，是一个 AI “自动修复”提交创造了这个注入向量。