AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

On June 18, 2026, a critical vulnerability was introduced into Snowflake's GitHub repository via an AI-generated code change. The impetus came from a GitHub Actions workflow that employed AI-assisted coding, specifically Copilot Autofix powered by AI. This workflow, when merged on June 18, allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner through a script injection vulnerability.

The vulnerability, initially flagged by the AI-powered Red Agent security research tool on the same day, permitted any GitHub user to open an issue and inject a specially crafted title which, when processed, executed malicious commands. The code change, credited to Copilot Autofix, removed the repository's existing safe input pattern, directly interpolating the attacker-controlled issue title into a shell script.

This alteration circumvented GitHub's AI-assisted security review, leading to the exploitation of Jira credentials. The vulnerability remained undetected for five days, from June 18 to June 23, 2026, during which an attacker could have potentially accessed sensitive Snowflake engineering, security compliance, and bug bounty tracking projects.

Following discovery, Snowflake swiftly patched the workflow, revoked the compromised JIRA token, and conducted a forensic verification confirming no external third parties accessed the endpoint during the exposure period. This incident underscores the risks of relying on AI-generated code and highlights the necessity for rigorous oversight to prevent security regressions in automated workflows.