Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR

Wiz Research's autonomous Red Agent discovered a critical script-injection vulnerability in Snowflake's public GitHub Actions workflow that interpolated untrusted issue titles into shell commands, enabling remote command execution and exfiltration of a Jira API token; Snowflake patched the workflow and rotated the credential the same day after responsible disclosure.