Wiz's AI agent found the Snowflake CI/CD flaw Copilot missed — inside Jira in days
Wiz's autonomous "Red Agent" found a GitHub Actions injection in Snowflake's snowflake-connector-net that let any unauthenticated user run arbitrary commands on a runner by opening an issue with a crafted title. The exfiltration reached Snowflake's internal Jira — and the vulnerable PR passed GitHub Advanced Security's Copilot-assisted scans untouched. Live only five days before disclosure, it's a stark warning: the AI-written CI/CD flaws nobody has found yet may outrank the ones we know about.