When AI Fixes Break Security Copilot Autofix Patch Leads to Credential Leak in Snowflake Repo.

AI Agent Exploits GitHub Actions Vulnerability Introduced by AI Code Fix in Snowflake Repository

Cybersecurity firm Wiz revealed a security vulnerability within a Snowflake open-source repository on GitHub, where an automated AI security patch unintentionally introduced a critical command injection flaw. The weakness was discovered and successfully exploited by Wiz's autonomous security auditing system, Red Agent, which extracted sensitive internal Jira API credentials.

The flaw occurred in Snowflake's snowflakedb/snowflake-connector-net repository. The project contained an automated GitHub Actions workflow designed to mirror newly opened GitHub issues into Snowflake’s internal Jira system. Originally, the workflow safely parsed issue titles using the jq JSON processor and environment variables (env). However, a automated code update co-authored by Copilot Autofix refactored the script to directly execute bash commands referencing inline GitHub event variables (github.event.issue.title).

This subtle change created an unsanitized command injection vector. By crafting a malicious payload inside a GitHub issue title, Wiz's Red Agent triggered the GitHub Actions runner to execute arbitrary bash code. The exploit successfully exfiltrated JIRA_API_TOKEN, JIRA_USER_EMAIL, and JIRA_BASE_URL variables to Wiz's testing server.

Upon receiving Wiz's disclosure, Snowflake immediately revoked the exposed API credentials, reverted the faulty patch, and verified that no malicious actors had exploited the vulnerability prior to remediation.

Wiz highlighted two vital lessons from the incident:

• AI-Generated Code Requires Strict Review: Automated code fixers can introduce subtle, catastrophic security flaws while attempting to fix minor code smells or syntax issues.

• The Shrinking Window of Exposure: Security vulnerability discovery is accelerating rapidly. Red Agent identified and exploited the newly introduced flaw just 5 days after the code update was committed.

Tools like Copilot Autofix are designed to quickly address static analytics alerts, often prioritizing code conciseness over security scope. When developers approve AI-generated pull requests without verifying how variables are handled in subsequent steps, automated fixes can unknowingly transform a secure analytics structure into a vulnerable inline assessment.

Wiz's Red Agent demonstrates how proactive security is shifting toward automated AI agents capable of continuously scanning code repositories, interpreting workflow files, and generating targeted attacks within days of a commit. As AI-powered defense tools make vulnerability discovery easier for both auditors and attackers, the time organizations have to audit and validate code changes is drastically reduced.

 

 

Source: Wiz 

💬 AI Content Assistant

Ask me anything about this article. No data is stored for your question.

AI Agent Exploits GitHub Actions Vulnerability Introduced by AI Code Fix in Snowflake Repository

Cybersecurity firm Wiz revealed a security vulnerability within a Snowflake open-source repository on GitHub, where an automated AI security patch unintentionally introduced a critical command injection flaw. The weakness was discovered and successfully exploited by Wiz's autonomous security auditing system, Red Agent, which extracted sensitive internal Jira API credentials.

The flaw occurred in Snowflake's snowflakedb/snowflake-connector-net repository. The project contained an automated GitHub Actions workflow designed to mirror newly opened GitHub issues into Snowflake’s internal Jira system. Originally, the workflow safely parsed issue titles using the jq JSON processor and environment variables (env). However, a automated code update co-authored by Copilot Autofix refactored the script to directly execute bash commands referencing inline GitHub event variables (github.event.issue.title).

This subtle change created an unsanitized command injection vector. By crafting a malicious payload inside a GitHub issue title, Wiz's Red Agent triggered the GitHub Actions runner to execute arbitrary bash code. The exploit successfully exfiltrated JIRA_API_TOKEN, JIRA_USER_EMAIL, and JIRA_BASE_URL variables to Wiz's testing server.

Upon receiving Wiz's disclosure, Snowflake immediately revoked the exposed API credentials, reverted the faulty patch, and verified that no malicious actors had exploited the vulnerability prior to remediation.

Wiz highlighted two vital lessons from the incident:

• AI-Generated Code Requires Strict Review: Automated code fixers can introduce subtle, catastrophic security flaws while attempting to fix minor code smells or syntax issues.

• The Shrinking Window of Exposure: Security vulnerability discovery is accelerating rapidly. Red Agent identified and exploited the newly introduced flaw just 5 days after the code update was committed.

Tools like Copilot Autofix are designed to quickly address static analytics alerts, often prioritizing code conciseness over security scope. When developers approve AI-generated pull requests without verifying how variables are handled in subsequent steps, automated fixes can unknowingly transform a secure analytics structure into a vulnerable inline assessment.

Wiz's Red Agent demonstrates how proactive security is shifting toward automated AI agents capable of continuously scanning code repositories, interpreting workflow files, and generating targeted attacks within days of a commit. As AI-powered defense tools make vulnerability discovery easier for both auditors and attackers, the time organizations have to audit and validate code changes is drastically reduced.

 

 

Source: Wiz