Copilot Autofix Opened GitHub Actions to Injection
Wiz says its Red Agent found and validated a GitHub Actions workflow-injection flaw in Snowflake's public snowflakedb/snowflake-connector-net repository, and Snowflake fixed it the same day after disclosure on June 23, 2026. The bad commit landed five days earlier, in a change co-authored by GitHub Copilot Autofix powered by AI.
The workflow took a GitHub issue title and dropped it into a shell command instead of keeping it as data. Because GitHub expands the title before the shell escapes anything, a quote in the title lets an unauthenticated issue author break out of the command and run their own code inside the runner; Wiz also validated access to Snowflake's internal Jira.
For teams that let AI assistants edit GitHub Actions, the exposure sits in the workflow layer, not just the repo. If an issue- or PR-triggered pipeline trusts assistant-written input handling, a public form can become a command-execution path into whatever systems the runner can reach.