Wiz Red Agent exploits GitHub Actions injection in Snowflake repository and reaches internal Jira

Wiz Research's autonomous Red Agent, working under Snowflake's HackerOne disclosure program, scanned Snowflake's GitHub organization and flagged a script injection flaw in a workflow in the snowflake-connector-net repository. The agent exploited it and obtained Jira credentials from a GitHub Actions runner. When its first attempt failed with a shell syntax error, it analyzed the error and adjusted its approach without human help. The credentials gave read access to Snowflake's internal Jira, and Wiz then reported the flaw and Snowflake fixed it the same day.

Export STIX 2.1 Export JSON Request a correction (GitHub issue)

Timeline

2026-06-18 PR #1218 was merged, making the vulnerable workflow pattern live. · Wiz Research

2026-06-23 Wiz Red Agent identified and exploited the flaw, and Wiz reported it to Snowflake via HackerOne. · Wiz Research

2026-06-23 Snowflake patched the workflow the same day. · Wiz Research

2026-06-24 The Jira token was rotated. · Wiz Research

2026-07-25 Public disclosure deadline under Snowflake's disclosure policy. · Wiz Research

2026-08-17 Wiz published the blog post. · Wiz Research

Sources · 1

Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR — Wiz Research, 2026-08-17

Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.

At a glance · as reported

Window	June 2026
Attacker	Wiz Research's Red Agent, an autonomous AI-powered security research tool, operating under Snowflake's HackerOne vulnerability disclosure program
Scale	Flaw live for five days (June 18 to June 23, 2026); one exfiltrated Jira token; read access across Snowflake's engineering, security compliance, and bug bounty tracking projects
Impact	Jira credentials were exfiltrated and used to validate read access to Snowflake's internal Jira. Audit logs showed Wiz was the only actor during the exposure window, and the data Wiz accessed was deleted.
Defender	Snowflake (public repository snowflake-connector-net and its internal Jira); GitHub Advanced Security and Copilot checks on the merged PR did not flag the flaw
Response	Snowflake patched the vulnerable workflow on June 23, 2026, rotated and revoked the affected Jira token, and verified through audit logs that Wiz was the sole actor. Snowflake said it found no evidence of unauthorized access.

Tactics (MITRE ATT&CK)

TA0001 Initial Access
TA0002 Execution
TA0006 Credential Access
TA0009 Collection
TA0010 Exfiltration
TA0043 Reconnaissance

Mapped by the maintainer from the reports.

Published by the weekly machine review (claude-sonnet-5-5 (automated review)) from the sources above on 2026-10-25: every field is as the sources state it, or empty. Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.