A GitHub Copilot Autofix commit deleted the input sanitizing already in Snowflake's public repo, and five days later an autonomous agent used it to walk out with credentials to Snowflake's internal Jira.
Letting an AI clear your security scanner's alert backlog is the rare AI use case that sells itself to a finance team in a single sentence. GitHub's own pricing page advertises that Copilot Autofix generates automatic fixes for 90 percent of alert types in JavaScript, TypeScript, Java, and Python, which takes a queue that used to eat an application security engineer's week and turns it into a stack of pull requests somebody approves between meetings. On Monday, Wiz published the receipt for what that approving-between-meetings step was actually worth: an Autofix commit in one of Snowflake's public repositories quietly deleted the input sanitizing that was already there, and five days later an autonomous agent walked through the opening and out with credentials to Snowflake's internal Jira.
What actually happened
The writeup from Wiz researcher Gal Nagli is worth reading in full, but the mechanics are simple enough to explain in a leadership meeting.
Snowflake's public snowflake-connector-net repository runs a GitHub Actions workflow that files Jira tickets off GitHub issues. The original version handled the issue title the safe way, passing it into the job as an environment variable and processing it with jq. In June, a pull request modernizing those Jira workflows included a commit co-authored by "Copilot Autofix powered by AI" that threw the safe pattern out and interpolated the raw issue title directly into a shell command instead.
That one substitution turned a public repository into a command prompt. Anyone with a GitHub account could open an issue, put a carefully constructed string in the title field, and run their own commands inside Snowflake's CI runner. "We crafted an issue title that, after template expansion, breaks out of the echo string and exfiltrates the Jira credentials via an out-of-band callback," is how Wiz's head of threat exposure described it to The Register.
The commit merged on June 18. On June 23, Wiz's Red Agent, an autonomous research tool that hunts and validates vulnerabilities without a human driving each step, found the flaw, exploited it, and pulled out a Jira API token with read access across Snowflake's engineering, security compliance, and bug bounty tracking projects. Snowflake patched the same day it was reported and rotated the token the next. Its audit logs showed Wiz was the only outside party to touch the endpoint during the five-day window. Public disclosure came Monday.
So an AI wrote the vulnerability and an AI found it. The humans appear in this story twice, once to merge and once to clean up.
Why this should change your math
Every AI coding tool is sold on the same arithmetic. The expensive human step gets absorbed by the model, and the savings land this quarter. What almost never gets priced is which human step you actually removed.
Here it was the reviewer, because the reviewer is the line item nobody can attach revenue to. And notice the failure mode. This was not a bug the AI invented out of nothing. It was a control that already existed and got deleted. That is the specific thing your tooling is worst at catching, because scanners flag what is wrong, not what used to be right and is not anymore. A diff that strips a safety pattern looks, at a glance, like a diff that simplifies some code.
Then notice where it landed. Not in the product. In CI plumbing, in a workflow that files Jira tickets, the kind of file no organization staffs a senior reviewer against. The blast radius was not the repository either. It was the internal issue tracker, including the project where unfixed vulnerabilities are catalogued.
And the tool that did it was the security tool. Copilot Autofix exists for exactly one purpose, which is remediating security findings. If the AI purpose-built for security work needs a human security reviewer on every diff, there is no honest argument that your general-purpose coding agent needs less.
The honest version
Nobody's data walked out the door. Snowflake found no evidence of unauthorized access, the token was read-only, and the single actor inside the window was the researcher who reported it. This is a demonstration, not a breach.
It is also one commit in one repository. Wiz published no count of how often this happens across the ecosystem, so anyone drawing a trend line through it is filling in numbers that do not exist yet. And GitHub is not hiding the ball. Its own documentation states plainly that Autofix "may suggest fixes that fail to remediate the underlying vulnerability or introduce new vulnerabilities," and that suggestions are proposed changes "that require explicit developer review and acceptance before being applied." The vendor wrote this exact failure mode down in advance. Somebody clicked approve anyway.
Which is the part worth sitting with. No model breakthrough, no exotic exploit. A documented limitation met a review process that had quietly become a formality, and that is a management outcome rather than a technical one.
The line item you cut was the reviewer. The invoice arrived four months later as a GitHub issue with a funny title.