Wiz’s AI hacks Snowflake: the new normal in cyber defense

Snowflake, a cloud giant trusted by companies to store, process, and share massive amounts of business data, left a path into one of its sensitive systems exposed on GitHub.

Wiz, a Google-owned cloud cybersecurity company, just hacked Snowflake – responsibly. No human was involved.

Wiz’s AI agent independently found and exploited a bug that was also introduced by Snowflake’s AI coding agent. Both Snowflake and GitHub’s Advanced Security AI tools missed it.

It was a GitHub Actions injection attack. For 5 days, unauthenticated users could execute arbitrary commands simply by opening a GitHub issue with a specially crafted title.

Using Snowflake’s flawed automation, Wiz managed to exfiltrate a secret token authenticated as [email protected] (likely referring to quality assurance) to an internal Jira, a platform companies use for bug tracking, task management, and project management.

An actual attacker could exfiltrate this sensitive information and use it to gain further access to Snowflake’s systems.

“This incident highlights a new reality in software development,” Wiz warns in the report on the discovered bug.

AI coding agents can introduce critical vulnerabilities, approve them, and these bugs then pass established automated security checks.

All “while autonomous AI security agents can rapidly discover and exploit them in the wild,” the researchers warn.

Snowflake fixed the bug on the same day it was reported and rotated the affected credential.

Our investigation found no evidence of unauthorized access. Protecting our systems remains a top priority, and we remain committed to continually strengthening our software development and security practices,

Snowflake said.

How did it happen?

It started as a benign code submission on GitHub – a cleanup job in Snowflake’s public repository “snowflake-connector-net.” The pull request (PR) was submitted on August 7th, 2025.

The conversation reveals interactions between bots: GitHub’s AI security bot caught problems twice, and Copilot-authored fix suggestions were committed in response.

But none of them were related to the critical vulnerability introduced with the code – the unescaped interpolation of Issue title (github.event.issue.title) directly into a shell script.

“In this incident, the merged PR removed a safe env: + jq parsing pattern and replaced it with direct string interpolation, while the existing security solution failed to flag the resulting injection that led to the exposure,” Wiz explains.

Ultimately, a human reviewer merged the code. GitHub Advanced Security scan analyzed the final PR revision, including the vulnerable workflow, but missed the critical injection.

The vulnerability became live on June 18th, 2026. Whenever someone files an issue, the GitHub Action automation with vulnerable code triggers.

An autonomous, AI-powered security research bot – Wiz Red Agent – independently found the bug 5 days later.

Then it exploited the bug, injecting code that exfiltrated the token, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius.

“All without human intervention,” Wiz’s report reads.

Wiz even demonstrated having access to Snowflake’s Jira portal, using the exfiltrated token.

The bot didn’t even succeed on the first try, but analyzed the execution error and adjusted its payload accordingly. The script was a simple curl command for sending web requests: it took the loaded secret environmental variable (JIRA_API_TOKEN), encoded it in base64, and beamed it to the attacker’s server as a query parameter in the URL.

The report states that Wiz disclosed the bug on the same day, June 23rd, 2026, but doesn’t explain whether it was done by a human.

Wiz warns that AI coding tools inadvertently reintroduce deprecated or insecure shell patterns, and vibe-coded submissions must undergo the same static analysis and security scrutiny as human code.

Meanwhile, defenders must be prepared for automated attacks to unfold within hours.

Wiz clarified that it is unclear whether an AI was solely responsible for introducing the bug. Copilot was a co-author, checked the merged PR, and identified it as “all-clear” without noticing critical flaws.