{
 "id": "TR-2026-021",
 "status": "published",
 "title": "Wiz Red Agent exploits GitHub Actions injection in Snowflake repository and reaches internal Jira",
 "date": "2026-06-23",
 "window": "June 2026",
 "ai_role": "attacker",
 "category": "red_team",
 "summary": "Wiz Research's autonomous Red Agent, working under Snowflake's HackerOne disclosure program, scanned Snowflake's GitHub organization and flagged a script injection flaw in a workflow in the snowflake-connector-net repository. The agent exploited it and obtained Jira credentials from a GitHub Actions runner. When its first attempt failed with a shell syntax error, it analyzed the error and adjusted its approach without human help. The credentials gave read access to Snowflake's internal Jira, and Wiz then reported the flaw and Snowflake fixed it the same day.",
 "attacker": {
  "description": "Wiz Research's Red Agent, an autonomous AI-powered security research tool, operating under Snowflake's HackerOne vulnerability disclosure program"
 },
 "defender": {
  "description": "Snowflake (public repository snowflake-connector-net and its internal Jira); GitHub Advanced Security and Copilot checks on the merged PR did not flag the flaw"
 },
 "scale": "Flaw live for five days (June 18 to June 23, 2026); one exfiltrated Jira token; read access across Snowflake's engineering, security compliance, and bug bounty tracking projects",
 "impact": "Jira credentials were exfiltrated and used to validate read access to Snowflake's internal Jira. Audit logs showed Wiz was the only actor during the exposure window, and the data Wiz accessed was deleted.",
 "tactics": [
  "TA0001",
  "TA0002",
  "TA0006",
  "TA0009",
  "TA0010",
  "TA0043"
 ],
 "timeline": [
  {
   "date": "2026-06-18",
   "text": "PR #1218 was merged, making the vulnerable workflow pattern live.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-06-23",
   "text": "Wiz Red Agent identified and exploited the flaw, and Wiz reported it to Snowflake via HackerOne.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-06-23",
   "text": "Snowflake patched the workflow the same day.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-06-24",
   "text": "The Jira token was rotated.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-07-25",
   "text": "Public disclosure deadline under Snowflake's disclosure policy.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-08-17",
   "text": "Wiz published the blog post.",
   "tier": null,
   "source": "1"
  }
 ],
 "lessons": [],
 "models_named": [],
 "related_agents": [],
 "vendor_response": "Snowflake patched the vulnerable workflow on June 23, 2026, rotated and revoked the affected Jira token, and verified through audit logs that Wiz was the sole actor. Snowflake said it found no evidence of unauthorized access.",
 "sources": [
  {
   "title": "Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR",
   "url": "https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug",
   "outlet": "Wiz Research",
   "date": "2026-08-17"
  }
 ],
 "reviewer": "model: claude-sonnet-5-5 (automated review)",
 "checked_on": "2026-10-25"
}