Wiz Research said its Red Agent independently found and exploited a GitHub Actions injection in a GitHub Copilot–assisted pull request, then validated access to Snowflake's internal Jira. The flaw had been live for five days when the agent found it, and GitHub Advanced Security had missed it. The injection sat in the PR review and automation path, so ordinary-looking review content could trigger attacker-controlled commands during CI/CD (continuous integration and continuous delivery). That makes the blast radius bigger than the repository itself: once workflow code runs, it can reach connected internal systems and expose sensitive operational data. For teams that use PR-triggered automation, the lasting lesson is that review-time trust is part of the attack surface. A flaw in the workflow can become a path into ticketing and other internal systems before manual review or security tooling notices anything wrong.