GitHub challenges Wiz’s assertion that Copilot Autofix was responsible for a flaw in Snowflake.

      A security firm announced on Monday that an AI introduced a significant vulnerability into Snowflake’s code, and another AI discovered it and exploited the system. The latter part is accurate, but the former aspect unraveled within approximately eight hours.

      What remains is still noteworthy, but it is not the narrative that gained traction.

      What the agent actually accomplished

      Wiz Research utilizes an autonomous tool known as Red Agent. It examined Snowflake’s GitHub organization as part of the company’s HackerOne disclosure program and identified a workflow file in the public repository for Snowflake’s .NET connector.

      This workflow activated whenever an issue was opened, directly inserting the issue title into a shell script that was accessible to any online account.

      The escaping was incorrectly ordered. GitHub’s template engine processed the title first, followed by commands intended to sanitize it. Thus, a single quote in the title caused it to break out of the shell string.

      The protective condition compared a pull request property with a bot name, but that property was absent during issue events. GitHub treated the missing property as an empty string, resulting in the comparison always returning true, allowing all users access.

      Then comes the crucial part. Red Agent’s first payload utilized a hash character to comment out the remaining line, causing a syntax error from the runner. The agent interpreted the error, realized that the comment had consumed a closing bracket, revised the payload, and attempted again. The callback was received within seconds, with no user interaction required.

      The token extracted provided read access to Snowflake’s engineering, security compliance, and bug bounty projects.

      Snowflake acted on the same day

      Wiz reported the vulnerability on June 23. Snowflake addressed the issue that same day, reinstating the secure pattern, and rotated the Jira token on June 24.

      Audit logs linked every unusual query to Wiz’s own testing addresses, and Wiz stated that it deleted the data it accessed.

      “The disclosure was received on June 23, 2026, and it was immediately investigated and remediated. Our investigation found no evidence of unauthorized access,” said Snowflake.

      The co-author detail is a squash artifact

      Here is where the misunderstanding originated.

      The commit that introduced the vulnerability to the main branch lists “Copilot Autofix powered by AI” as one of its co-authors. Wiz interpreted this as meaning an AI was responsible for the vulnerable code. Its post claimed that an AI autofix commit generated the injection vector, and most coverage followed suit.

      However, Hacker News explored the underlying commits. The co-authored commit from Copilot altered a different file, while the unsafe refactor appears in a separate commit dated August 25, 2025, which GitHub attributes to a specific Snowflake engineer.

      Squashing merges every commit in a pull request into a single one, and the co-author line accompanied it. This indicates participation in the pull request, not authorship of the flawed code. Reporter Swati Khandelwal summarized it clearly: the history indicates Copilot’s involvement but does not confirm that it crafted the flaw.

      GitHub’s response

      GitHub conducted an internal review and refuted the narrative. It asserted that a human authored the contributions leading to the vulnerability and that Copilot Autofix neither reviewed nor contributed to them.

      Wiz adjusted its post later that evening. An update timestamped 19:57 UTC indicated that Copilot was a co-author that examined the merged pull request and deemed it free of vulnerabilities, but noted: “It’s unclear whether the code change was AI-assisted.”

      The Register had already reported the story. By midnight, it changed its headline to reflect that an AI failed to identify the issue rather than having caused it, and issued a correction. Cybersecurity editor Jessica Lyons concluded with a rare statement from a major vendor: “The Register regrets this error, has updated this story to reflect the revised information, and won’t be trusting Wiz for a very long time.”

      Two noteworthy owners

      Google owns Wiz, while Microsoft owns GitHub and Copilot.

      This doesn’t necessarily invalidate the research, but it does indicate that a Google-owned company claimed a Microsoft product was responsible for a critical flaw and later retracted the key portion after scrutiny.

      What remains significant

      Removing the disputed portion leaves a substantial finding.

      An autonomous agent scanned a public repository, detected a live injection, crafted an exploit, encountered an error, diagnosed it, corrected itself, and successfully retrieved working credentials. The vulnerability was active for five days, marking the entire timeframe for exploitation.

      We have been tracking this trend. In July, researchers jailbroke Copilot workflows, and a different GitHub agent leaked private repositories just a day prior.

      Since then, AI-discovered vulnerabilities have transitioned into real exploitation. Recently, we reported that an agent developed a working exploit for a macOS flaw in just four hours.

      Greg Brockman admitted on