GitHub disputes Wiz’s claim that Copilot Autofix wrote a Snowflake flaw
A security company said on Monday that an AI wrote a critical flaw into Snowflake’s code, and that another AI found it and broke in. The second half holds up. The first half came apart in about eight hours.
What is left is still worth your attention. It is just not the story that travelled.
What the agent actually did
Wiz Research runs an autonomous tool it calls Red Agent. It scanned Snowflake’s GitHub organisation under the company’s HackerOne disclosure programme and flagged a workflow file in the public repository for Snowflake’s .NET connector.
The workflow ran whenever anyone opened an issue. It dropped the issue title straight into a shell script. Any account on the internet could reach it.
The escaping sat in the wrong order. GitHub’s template engine substituted the title first, and the commands meant to sanitise it ran afterwards. A single quote in the title therefore...
Copyright of this story solely belongs to thenextweb.com. To see the full text click HERE
