An AI security tool found a critical Snowflake bug. The bug was introduced by another AI.

On June 18, 2026, a commit landed in the public repository snowflakedb/snowflake-connector-net that removed a working input-sanitization pattern from a GitHub Actions workflow. The commit was PR #1218, co-authored by GitHub Copilot's Autofix, the AI-assisted code-fixing feature inside GitHub Copilot. The file it changed was a CI/CD file, not the code Autofix had been asked to edit. Five days later, an autonomous AI security tool exploited the workflow and reached Snowflake's internal Jira.

The workflow in question, jira_issue.yml, ran every time someone opened a new issue on the repository. It took the issue's title, an attacker-controlled string, and dropped it directly into a shell run: block. The previous version had wrapped that input in a sanitization pattern. The Autofix commit replaced the wrapper with a raw echo "$title" line, relying on a downstream sed chain to clean the output after the shell had already expanded it. That ordering is the textbook recipe for a script-injection vulnerability in GitHub Actions: a single quote in an issue title breaks out of the echo and runs arbitrary commands on Snowflake's CI runner, with no authentication required. GitHub's own security team has documented this exact class of bug in its script-injection guidance and in a GitHub Security Lab writeup on untrusted input. The failure mode is not new, and the fix is not new.

Wiz Research operates an autonomous AI-powered security research tool called Red Agent. The agent continuously scans public repositories for vulnerabilities, including the kind of CI/CD regression that lands inside an unrelated diff. On June 23, five days after PR #1218 merged, Red Agent identified the workflow injection, opened a test issue with a malicious title, and demonstrated arbitrary command execution on Snowflake's GitHub Actions runner. From there, Wiz chained the access to Snowflake's internal Jira instance, mapped the blast radius, and disclosed the finding to Snowflake through the HackerOne vulnerability disclosure program.

The disclosure window, five days from regression to report, is the part of the story that shows how the new model is supposed to work. Snowflake remediated the workflow the same day it received the report via PR #1402, rotated the affected credential, and confirmed through audit logs that Wiz was the sole actor during the exposure window. Wiz, for its part, deleted all proof-of-concept data after the disclosure. The pattern, autonomous AI auditor on one side, AI-generated regression on the other, same-day human remediation in the middle, is what a continuous security pipeline is starting to look like.

The structural lesson is more specific than the "AI versus AI" framing. AI coding assistants can strip human-applied defenses while editing something unrelated, and the files where that matters most are the ones that turn user input into shell commands. [The vulnerable jira_issue.yml is still available at the pinned commit](https://raw.githubusercontent.com/snowflakedb/snowflake-connector-net/4a1b8cecd65b899540e4324715557d6b080ddeb5/.github/workflows/jira_issue.yml), alongside [the patched version on master](https://raw.githubusercontent.com/snowflakedb/snowflake-connector-net/master/.github/workflows/jira_issue.yml), so any team can diff them and see exactly what Autofix removed. The pattern is reproducible in any repository that lets Autofix touch files under .github/workflows/.

Two practical moves follow. The first is at review time: treat any AI-generated diff that touches a CI/CD file or a shell-expansion sink as a separate review class, with a human security reviewer or an autonomous auditor in the loop before merge. The second is post-merge: have a Red-Agent-style scanner watch the workflow files of every public repository a team owns, the way Wiz watched Snowflake's, and alert on the same regression class the moment it lands. The cost of either control is small compared to a CI runner that an unauthenticated GitHub user can drive with one crafted issue title.

The honest caveat: this is a single documented instance, not a measured regression rate across Copilot Autofix commits. Snowflake's outcome was good because the disclosure pipeline worked, not because the bug could not have been worse. The transferable question is not whether AI assistants will sometimes remove working security patterns in unrelated edits. That is now a documented behavior. The real question is whether the review pipeline catches the regression before a Red Agent, human or autonomous, does.