Security company Wiz published research on 17 August describing how its autonomous offensive-security agent discovered and exploited a script-injection vulnerability in a GitHub Actions workflow belonging to the public snowflakedb/snowflake-connector-net repository, and used it to exfiltrate a token that granted read access to Snowflake's internal Jira.
The timeline is unusually tight
The vulnerability went live when PR #1218 merged on 18 June 2026. Wiz identified it, exploited it and reported it through HackerOne on 23 June; Snowflake patched the same day in commit 1dc7766, and rotated the Jira token on 24 June. Exposure was five days. The token authenticated as qa@snowflake.net to Snowflake's Atlassian tenant, granting read access across engineering, security-compliance and bug-bounty tracking projects.
What the common framing gets wrong
The story is circulating as "an AI wrote the bug and another AI exploited it." That symmetry is the part nobody can stand behind. GitHub's position, given to reporters, is that the contributions leading to the vulnerability were authored by a human and were neither reviewed by nor contributed to by Copilot. Wiz's own post appends an update conceding that it is unclear whether the code change was AI-assisted, and notes that Copilot Autofix's documented contribution in that pull request was a separate fix to a different file. So the authorship claim is disputed by the vendor and hedged by the researcher — yet it is the claim carrying the coverage.
The undisputed finding is the more serious one
What nobody contests: an autonomous agent assembled the whole kill chain unaided — reconnaissance, discovery of an injectable workflow, exploitation, credential exfiltration and lateral movement into a separate SaaS system — against a major data-platform vendor. And whoever wrote the flaw, GitHub's own scanning did not flag it before merge. That is a finding about defensive coverage, and it does not depend on the authorship dispute at all.
What was and was not reached
A third distortion is worth naming. This was a public connector repository's CI workflow, and the access obtained was read access to Jira projects. It was not the Snowflake data platform, and it was not customer data. Snowflake says its investigation found no evidence of unauthorised access beyond the researchers, and that audit logs showed Wiz was the only third party on the endpoint. "Snowflake breached" and "Jira read via an Actions runner" are not the same sentence.