A security firm announced on Monday that an AI wrote a critical flaw into Snowflake's code, and another AI found it and broke in. The second half holds up. The first half fell apart in about eight hours.

What remains is still worth your attention. It is just not the story that travelled.

What the agent actually did

Wiz Research runs an autonomous tool it calls Red Agent. It scanned Snowflake's GitHub organisation under the company's HackerOne disclosure programme and flagged a workflow file in the public repository for Snowflake's .NET connector.

The workflow ran whenever anyone opened an issue. It dropped the issue title straight into a shell script. Any account on the internet could reach it.

The escaping sat in the wrong order. GitHub's template engine substituted the title first, and the commands meant to sanitise it ran afterwards. A single quote in the title therefore broke out of the shell string.

A guard condition looked protective. It compared a pull request property against a bot name, but on issue events that property does not exist. GitHub evaluates a missing property as an empty string, so the comparison always returned true and every user walked through.

Then came the part that matters. Red Agent's first payload used a hash character to comment out the rest of the line, and the runner threw a syntax error. The agent read the error, worked out that the comment had swallowed a closing bracket, rewrote the payload, and tried again. The callback arrived within seconds. Nobody touched a keyboard.

The token it pulled out granted read access across Snowflake's engineering, security compliance, and bug bounty projects.

Snowflake moved the same day

Wiz reported the flaw on 23 June. Snowflake patched it that day, restored the safe pattern, and rotated the Jira token on 24 June.

Audit logs matched every anomalous query to Wiz's own testing addresses. Wiz says it deleted what it took.

“The disclosure was received on June 23, 2026, and it was immediately investigated and remediated, and our investigation found no evidence of unauthorized access,” Snowflake said.

The co-author line is a squash artefact

Here is where it went wrong.

The commit that carried the flaw onto the main branch lists “Copilot Autofix powered by AI” among its co-authors. Wiz read that as an AI writing the vulnerable code. Its own post said an AI autofix commit created the injection vector. Most coverage followed.

A tech news outlet went and read the commits underneath. Copilot's co-authored commit changed a different file. The unsafe refactor sits in a separate commit dated 25 August 2025, which GitHub attributes to a named Snowflake engineer.

Squashing folds every commit in a pull request into one. The co-author line came along for the ride. It records participation in the pull request, not authorship of the lines that broke. The reporter who looked into it put it plainly: the history confirms Copilot took part, and does not establish that it wrote the flaw.

GitHub's answer

GitHub ran an internal review and rejected the framing. It says a human wrote the contributions that led to the vulnerability, and that Copilot Autofix neither reviewed nor contributed to them.

Wiz softened its own post the same evening. An update timestamped 19:57 UTC now says Copilot was a co-author that checked the merged pull request and called it clear without noticing the vulnerability. Then it adds the sentence that undoes the headline: “It's unclear whether the code-change was AI-assisted.”

One publication had already published a story blaming AI. By midnight it had changed its headline from an AI breaking the code to an AI failing to detect it, and appended a correction. Its cybersecurity editor ended with a line you do not often see about a major vendor: “We regret this error, have updated this story to reflect the revised information, and won't be trusting Wiz for a very long time.”

Two owners worth naming

Google owns Wiz. Microsoft owns GitHub, and Copilot with it.

That does not make the research wrong. It does mean a Google-owned firm published a claim that a Microsoft product wrote a critical flaw, then withdrew the load-bearing part of it once people checked.

What survives, and it is not small

Strip out the disputed half and a real finding remains.

An autonomous agent scanned a public repository, spotted a live injection, wrote an exploit, hit an error, diagnosed it, corrected itself, and took working credentials. The flaw was live for five days. That was the entire window.

We have been tracking this curve. Researchers jailbroke Copilot workflows in July, and a separate GitHub agent leaked private repositories a day earlier.

Since then AI-discovered flaws have moved into real exploitation. Only a day before this incident, another agent built a working exploit for a macOS flaw in four hours.

Greg Brockman conceded on Sunday that OpenAI had underestimated its own models on exactly this. The direction of travel is not in question.

What the record does not show

Several things remain unestablished, and the gap matters given how the claim spread.

No CVE exists. No CVSS score, and no entry in the US catalogue of exploited vulnerabilities. The weakness sat in repository automation, so no connector release carried it, and no evidence points to anyone else exploiting it.

Snowflake's audit logs are not public. Neither are the Jira permissions or the workflow run. Everything about the blast radius rests on what Snowflake and Wiz say they saw.

One more detail deserves a mention. GitHub published guidance in July 2025 warning against exactly this pattern, a month before the commit that introduced it.

What would settle it

The useful question is not which AI to blame. It is whether GitHub's AI review looked at this change and passed it.

Wiz says it did. GitHub says Copilot Autofix never reviewed the code at all. Those cannot both be true, and only one company holds the logs that would show it.

Source:TNW | Data-security News