AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

Wiz Research, using its AI tool "Red Agent," discovered a critical GitHub Actions workflow vulnerability in a Snowflake public repository. The vulnerability, introduced by commit 094038e and merged via PR #1218, involved an injectable pattern in jira_issue.yml. GitHub Copilot Autofix contributed a separate fix in the same PR, but GitHub Advanced Security failed to flag the injection. Snowflake remediated the issue reported on June 23, 2026, finding no evidence of unauthorized access, and is collaborating with Wiz to share these security learnings.