Wiz AI agent exposes Snowflake workflow security gap

A security agent created by Wiz identified and exploited a critical flaw in a Snowflake GitHub Actions workflow, even though the code had passed checks by GitHub's Advanced Security. The flaw, which became active on June 18, allowed an unauthorized GitHub user to execute arbitrary commands by opening an issue with a specifically crafted title.

The vulnerable workflow automatically generated Jira tickets when issues were opened and functioned using credentials that could access Snowflake's internal Jira environment. Wiz's AI-powered Red Agent, during authorized security research through Snowflake's HackerOne program, detected the script injection vulnerability while initially encountering an error.

The agent then modified its payload and successfully obtained the GitHub Actions runner's credentials. The exposed Jira token granted unauthorized access to sensitive projects, including engineering, security compliance, and bug bounty tracking. Snowflake's investigation found no unauthorized third-party access during the five-day period when the vulnerable workflow was active.

The vulnerability arose from the workflow's handling of issue titles, which were directly inserted into a shell command without proper sanitization, allowing an attacker to inject malicious commands. Although GitHub Advanced Security scanned the final pull request revision without detecting the flaw, the incident highlights the limitations of automated code scanning and the growing role of AI in both software development and cybersecurity.