Wiz's autonomous Red Agent exploited a GitHub Actions script-injection flaw in Snowflake's repo and exfiltrated credentials, proof that AI can weaponize CI bugs and that co-author metadata can't pin the blame.
Wiz's autonomous Red Agent walked into Snowflake's public snowflake-connector-net repo and turned a GitHub Actions flaw into a working exploit, no human in the loop. The jira_issue.yml workflow interpolated ${{ github.event.issue.title }} straight into a shell block, so any unauthenticated user could run arbitrary commands on a runner just by opening an issue.
The agent didn't just find the bug. It crafted an exploit, survived a failed first attempt, adapted the payload, and exfiltrated Jira credentials before Snowflake patched the same day. The workflow arrived via PR #1218, commit 4a1b8ce, merged June 18. Disclosure came June 23, with no CVE reference.
The script-injection vector is not new, and it's the part you can act on. Anywhere you interpolate ${{ github.event.* }} into a shell block, you've opened the same hole. Treat untrusted event fields as untrusted input, and if a runner touches secrets, assume an issue title is a payload.
The second lesson is attribution. GitHub pushed back on Wiz's claim that Copilot Autofix wrote the vulnerable code, pointing to a human-authored commit, even though Copilot reviewed the merged PR and flagged it all-clear. PR co-author metadata is not reliable enough to pin a vulnerable line on AI versus a human.
A preprint scan of 3,171 repositories finds 16% of AI coding-agent setups carry a security defect, with 9.8% installing unpinned MCP servers that run with your privileges.
1 source
Google announced WebMCP, an open standard turning websites into agent toolkits, and built-in Gemini Nano in Chrome for on-device AI. Here's what the agentic web means for how we build and how users interact with our applications.
1 source
AI-generated code gets higher marks than human code during review, but 82% of orgs hit production failures from it, 86% of senior devs spend more time fixing it, and a new term is born: agent debt.
2 sources