Copilot Autofix Did Not Write the Snowflake Flaw, GitHub Say

Copilot Autofix did not write the Snowflake flaw, GitHub say

A security company said on Monday that an AI wrote a critical flaw into Snowflake’s code, and that another AI found it and broke in. The second half holds up. The first half came apart in about eight hours. What is left is still worth your attention. It is just not the story that travelled. […] This story continues at The Next Web

Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection

Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials. The issue was present in .github/workflows/jira_issue.yml, which ran when a

Copilot Autofix Introduced a Critical CI/CD Bug at Snowflake. Here's How to Harden GitHub Actions

On June 23, an autonomous AI security tool walked into Snowflake's internal Jira. It did not... Tagged with ai, security, java, devops.