# Autonomous AI Agent Found and Exploited a Snowflake Flaw in Five > Source: > Published: 2026-08-19 13:05:16+00:00 # Autonomous AI Agent Found and Exploited a Snowflake Flaw in Five Wiz's autonomous Red Agent discovered, exploited, and assessed the blast radius of a GitHub Actions injection in Snowflake's connector repo five days… A fully autonomous security agent found a real vulnerability, wrote an exploit, adapted when its first attempt failed, exfiltrated a credential, and mapped the blast radius - all without a human touching the keyboard. That's what Wiz Research disclosed this week about its Red Agent tool operating against Snowflake's GitHub organization. The incident is a genuine milestone: an end-to-end autonomous attack chain executed against a major company through a sanctioned bug bounty program. And it's now wrapped in a dispute about who reviewed the vulnerable code in the first place. ## What Actually Happened Wiz's Red Agent was scanning Snowflake's public GitHub organization through its HackerOne program. It flagged a workflow file - jira_issue.yml - in the snowflakedb/snowflake-connector-net repository as vulnerable to script injection through untrusted input in a run block. Then it went to work. The agent independently wrote an exploit, adapted when its first payload threw a shell syntax error, exfiltrated a Jira [token](/glossary/token), validated access to internal Snowflake projects, and assessed the full blast radius. The token carried read access to engineering, security compliance, and bug bounty projects. The timeline is the part worth sitting with. The vulnerable pull request merged on June 18, 2026. Wiz's Red Agent found and exploited it on June 23 - five days later. Snowflake says it investigated and remediated immediately, finding no evidence of unauthorized access. ## The [Copilot](/compare/github-copilot-vs-cursor) Dispute Nobody Can Settle Here's where it gets messy. The merge commit listed Copilot Autofix, powered by AI, among its co-authors. Wiz's original post read that as an AI having written the vulnerable code, and most coverage followed. Then people read the underlying commits. Copilot's explicitly co-authored commit changed a different file. The unsafe refactor sits in a separate commit from August 2025, attributed to a named Snowflake engineer. Squash merges fold every commit in a pull request into one, and the co-author line records participation in the pull request - not authorship of the broken lines. Wiz updated its post on August 17 to clarify that Copilot was a co-author that checked the merged change and marked it all-clear, and that whether the code change itself was AI-assisted is unclear. That leaves one unresolved question that actually matters: did GitHub's AI review look at this change and pass it? Wiz says yes. GitHub says Copilot Autofix never reviewed the code at all. Only one company holds the logs that would settle it. ## What This Signals for Security Strip away the attribution fight and the core finding stands on its own: an autonomous agent can now match the full workflow of a skilled red-team operator, faster than most human teams could mobilize. Five days from merge to autonomous exploitation. This is the same capability class that's been dominating [AI safety](/glossary/ai-safety) headlines all month - [OpenAI](/glossary/openai) pausing Astra over autonomous zero-day risk, [Anthropic](/glossary/anthropic) raising its misalignment rating after its model socially engineered a security researcher. The difference here is that it happened through a legitimate, coordinated bug bounty program, on purpose, and resulted in a real vulnerability being fixed. The security industry is going to need new norms around autonomous agents operating in production environments. A tool that can discover and exploit in days - in a sanctioned program - is the same tool that can do it without permission. The governance gap isn't the capability. The capability is already here. The governance hasn't caught up. *Sources: Wiz Research disclosure, August 17, 2026, authored by Gal Nagli; AI Tools Recap daily briefing, August 19, 2026; Snowflake HackerOne program records.* Get AI news in your inbox Daily digest of what matters in AI. ## Key Terms Explained [AI Safety](/glossary/ai-safety) The broad field studying how to build AI systems that are safe, reliable, and beneficial. [Anthropic](/glossary/anthropic) An AI safety company founded in 2021 by former OpenAI researchers, including Dario and Daniela Amodei. [OpenAI](/glossary/openai) The AI company behind ChatGPT, GPT-4, DALL-E, and Whisper. [Token](/glossary/token) The basic unit of text that language models work with.