A recent incident has highlighted the risks of automation in software development, as a Snowflake GitHub Actions vulnerability escaped AI security checks and was later exploited by another AI-driven tool. The Snowflake flaw, found in a GitHub workflow, allowed Wiz’s autonomous Red Agent to access internal Jira credentials. This event underscores the evolving threat landscape where both attackers and defenders increasingly leverage artificial intelligence.
How the Snowflake GitHub Actions vulnerability was introduced
The vulnerability appeared in the GitHub Actions workflow named jira_issue.yml within Snowflake’s snowflake-connector-net repository. The affected code was merged on 18 June 2024 as part of pull request PR#1218. Notably, GitHub Copilot, an AI-powered code assistant, had reviewed the code but failed to detect the critical vulnerability. GitHub Advanced Security also scanned the workflow after the change but did not flag the flaw.
The vulnerable workflow was triggered whenever a new GitHub issue was opened. It used the issue title as an argument in a shell command, without proper sanitisation or input validation. This allowed attackers to inject arbitrary commands via the issue title. Although a protection was in place to prevent exploitation by untrusted users, it was designed for pull requests rather than issues. This mismatch rendered the check ineffective, meaning any GitHub user could potentially exploit the workflow.
- Date vulnerability introduced: 18 June 2024 (PR#1218 merged)
- Repository affected: snowflake-connector-net
- Vulnerable workflow: jira_issue.yml
- AI checks involved: GitHub Copilot (review), GitHub Advanced Security (scan)
Wiz’s Red Agent discovers and exploits the flaw
Wiz, a cloud security company, employs an autonomous AI tool called Red Agent to conduct security research. Red Agent scanned Snowflake’s public GitHub repositories and identified the vulnerable workflow. To exploit the vulnerability, Red Agent created a malicious GitHub issue with a specially crafted title. The payload was designed to break out of the shell’s echo statement and execute a command that would exfiltrate Snowflake’s internal Jira credentials.
Red Agent’s first attempt failed due to a syntax error. However, the agent analysed the error message, adjusted its payload, and succeeded on the second attempt. The exploit caused the GitHub Actions runner to send an out-of-band callback containing the base64-encoded Jira credentials to an external listener controlled by Wiz. Using these credentials, Red Agent was able to authenticate to Snowflake’s internal Atlassian environment, gaining read access to sensitive engineering and security compliance data.
- Date vulnerability exploited: Shortly after 18 June 2024
- Type of attack: Command injection via GitHub issue title
- Exfiltrated data: Internal Jira credentials
- Attack automation: Fully autonomous (Red Agent)
Timeline of discovery, exploitation and remediation
- 18 June 2024: Vulnerable code merged into repository (PR#1218)
- Post-merge: GitHub Copilot and Advanced Security fail to flag flaw
- Red Agent scan: Wiz’s AI tool discovers vulnerability, attempts exploitation
- Second attempt: Successful exfiltration of Jira credentials
- 23 June 2024: Wiz reports the issue to Snowflake via HackerOne
- 23 June 2024: Snowflake investigates and remediates the vulnerability the same day
- Post-remediation: Snowflake finds no evidence of unauthorised access beyond the controlled research activity
Why this AI-driven attack on Snowflake matters
This incident is significant for several reasons. First, it highlights the limitations of current AI-based code review and security tools. Despite scrutiny from GitHub Copilot and Advanced Security, the vulnerability was not detected before it was exploited. Second, the attack demonstrates how autonomous agents can chain together reconnaissance, exploitation and exfiltration without human intervention. Finally, the rapid remediation by Snowflake shows the value of coordinated vulnerability disclosure but also underscores the need for more robust defences in CI/CD pipelines, especially where workflows handle untrusted input.
Immediate actions for affected organisations
Organisations using GitHub Actions should:
- Review all workflows for use of untrusted input, especially in shell commands.
- Update or add input validation and sanitisation for all user-supplied data.
- Ensure that workflow protections match the event type (e.g. distinguishing between issues and pull requests).
- Consider additional manual code reviews for security-sensitive automation.
This event also suggests that organisations cannot rely solely on AI-driven code analysis for security assurance. Human oversight and prompt response to vulnerability disclosures remain essential components of a resilient security strategy.
Originally reported by csoonline.com.
