"The Red Agent identified a script injection vulnerability in the snowflakedb/snowflake-connector-net GitHub Actions on June 23," Wiz Research reported — a flaw that had been live since a pull request merged five days earlier and that GitHub’s own Advanced Security scan did not flag.
Red Agent: autonomous discovery and end‑to‑end exploitation
Wiz Research attributes the finding to Red Agent, an autonomous, AI‑powered security research tool. According to Wiz, the Red Agent not only identified the script injection but "independently discovered and exploited the GitHub Actions injection, validated access to sensitive data in Snowflake’s internal Jira connector and assessed the blast radius, all without human intervention." Wiz reported the vulnerability to Snowflake via HackerOne on June 23.
snowflakedb/snowflake-connector-net GitHub Actions: the vulnerable workflow
The vulnerability was present in the snowflakedb/snowflake-connector-net repository. A merged pull request, PR #1218, went live on June 18 and introduced a workflow that allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner by opening a GitHub issue with a specially crafted title. Wiz researchers discovered the problem while conducting security research through Snowflake’s HackerOne vulnerability disclosure program.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildGitHub Advanced Security and GitHub Copilot Autifx
Wiz’s report calls attention to the fact that the GitHub Advanced Security scan — which the source describes as using GitHub Copilot Autifx — analyzed the final revision of the pull request including the vulnerable workflow. "However, it did not flag the critical injection," noted Gal Nagli, head of threat exposure at Wiz Research, in a report published on August 17.
Snowflake response: patch, token rotation, and public statement
Snowflake patched the vulnerable script‑injection workflow on June 23 with commit 1dc7766 (PR #1402) and rotated the Jira token on June 24. In a public disclosure Snowflake said, "The disclosure was immediately investigated and remediated, and our investigation found no evidence of unauthorized access." Snowflake also stated it is "working together with Wiz to share these learnings with the broader industry to encourage widespread adoption of these security best practices."
What this means for open-source maintainers, GitHub Advanced Security, and Snowflake customers
- Open‑source maintainers and CI workflow authors: A workflow merged into a public repository (PR #1218) contained an input path that could be abused via an issue title, demonstrating how untrusted inputs in automation can create a remote execution vector. The episode underscores attention to how GitHub Actions process external content.
- GitHub Advanced Security and scanning vendors: The final PR revision and its vulnerable workflow were scanned by GitHub Advanced Security using GitHub Copilot Autifx but were not flagged, per Wiz's August 17 report. That gap will be salient for platform providers assessing detection coverage for script‑injection patterns in workflows.
- Snowflake and enterprise customers: Snowflake patched the workflow the same day Wiz reported it and rotated an internal Jira token the next day; the company reported no evidence of unauthorized access. Customers and procurement teams will likely follow the subsequent sharing of "security best practices" mentioned by Snowflake.
This incident is notable for two reasons the record lays out plainly: an autonomous AI agent both discovered and demonstrated the impact of a critical workflow vulnerability, and a platform security scan that reviewed the same final code did not flag it. Snowflake’s rapid patching and token rotation closed the immediate vector, and both Wiz and Snowflake say they will share lessons learned. The remaining question the facts leave on the table is whether owners of public automation and the scanners that audit them will translate those lessons into concrete, industry‑wide changes in detection and workflow hygiene.
Original story: https://www.infosecurity-magazine.com/news/wiz-ai-agent-finds-snowflake/
