Snowflake flaw slips past AI checks, gets exploited by another AI

Snowflake flaw slips past AI checks, gets exploited by another AI

An autonomous AI security agent developed by cloud security firm Wiz identified and exploited a critical vulnerability in Snowflake’s GitHub Actions pipeline, while GitHub Copilot had previously reviewed the code change without flagging the flaw. The vulnerable code was part of a pull request (PR) that GitHub Copilot was involved in, though Wiz has clarified that it is unclear whether the coding assistant itself introduced the vulnerability. “Co…

Critical Snowflake GitHub Actions Flaw Allows Attackers to Steal Internal Jira Credentials

A significant GitHub Actions injection vulnerability in Snowflake’s public snowflake-connector-net repository. This flaw could have allowed unauthenticated attackers to execute commands on a GitHub-hosted runner and potentially steal internal Jira credentials. The vulnerability was discovered by Wiz Red Agent, an autonomous AI-powered security research tool, just five days after the vulnerable workflow was deployed. Snowflake […] This article ha…

Wiz CTO speaks out amid confusion over Snowflake-GitHub Copilot flaw

Wiz claims its AI found a flaw written and reviewed by GitHub Copilot, but the developer platform has pinned the blame on boring old human error. In a blog post this week Wiz Research said that its Red Agent, an AI-powered bug hunting tool, had spotted a vulnerability in one of Snowflake's public repositories. That is very much what Red Agent is designed to do, but the Google-owned security company claimed that the flaw had actually been introdu…