An AI 'autofix' introduced the bug that leaked Snowflake's Jira tokens

Security firm Wiz has documented a case where an AI security fix created the exact hole it was supposed to close. In June, a commit to Snowflake's snowflake-connector-net repository, co-authored by "Copilot Autofix powered by AI" in PR #1218, rewrote a GitHub Actions workflow that ran on every new issue. The original code read the issue title through an environment variable and parsed it as structured JSON with jq, which is the safe pattern. The AI change threw that out and dropped the raw issue title straight into a shell command instead.

That one substitution turned the workflow into a command injection. A single quote in an issue title breaks out of the shell string, so an attacker could open an issue whose title runs arbitrary commands on the runner. Wiz used it to read a Jira API token tied to qa@snowflake.net and reach Snowflake's internal Jira, including engineering and security projects. A protective if: gate existed but checked github.event.pull_request.user.login, which is always empty for issue events, so it never blocked anything. Snowflake patched the same day it was reported and says no outside party had exploited the flaw first.

The uncomfortable detail is who wrote the vulnerability. The commit carried the polish of an automated security tool, the kind of change a reviewer waves through because it is labeled a fix. Wiz's own agent then found and exploited it within days of it landing.

Why it matters

If your team merges AI-generated security patches, this is the argument for reviewing them as closely as any other change to a workflow that touches secrets. A fix that removes sanitization is worse than no fix, and the "powered by AI" label is what makes it easy to miss.