Here's a sentence that would've sounded like science fiction three years ago: an AI agent broke into a Fortune 500 company's internal Jira system, and the company that built the AI is now writing blog posts bragging about it.
That's exactly what happened this month. Wiz, the cloud security company, let its autonomous AI system — nicknamed Red Agent — loose on a public GitHub repository belonging to Snowflake, the data cloud giant. Red Agent found a script injection flaw in Snowflake's GitHub Actions workflow, then didn't just flag it. It exploited it. On its own.
How an AI Talked Its Way Into a Jira Server
The vulnerability lived in snowflakedb/snowflake-connector-net, a public repo. A workflow there was configured to automatically spin up Jira tickets whenever someone opened a GitHub issue — a nice little automation, except the workflow ran with credentials that could reach Snowflake's internal Jira environment, covering engineering, security compliance, and even bug-bounty tracking.
Red Agent figured out it could craft a GitHub issue title that got executed as a command inside the Actions runner. Its first attempt threw a shell syntax error. Instead of giving up, it read the failure, adjusted its payload, and tried again. Second attempt worked. It pulled credentials straight out of the runner and used them to poke around Snowflake's internal ticketing system.
The unsettling part isn't the bug itself — script injection in CI/CD pipelines is a known category of mistake. It's that the vulnerable code had already passed through GitHub Advanced Security's automated scanning, and human reviewers signed off on the pull request that introduced it. Everyone missed it. The AI didn't.
The Copilot Blame Game Nobody Needed
Wiz's original writeup implied GitHub Copilot Autofix had a hand in approving the flawed code, which made for a juicier headline — AI missed the bug an AI later exploited. GitHub pushed back hard, stating the contribution was authored and reviewed entirely by humans, no Copilot involvement. Whoever's right, the messier truth is the one that matters: a five-day-old merge, reviewed by trained engineers at a major security-conscious company, contained a hole an autonomous agent walked through in a single afternoon.
This Isn't an Isolated Stunt
Zoom out and the Snowflake incident fits a pattern that's been accelerating all year. OpenAI recently slowed development on its Astra model after internal testing suggested it was approaching what the company calls "Critical" offensive capability — the point where a model can autonomously find and exploit zero-days without a human steering it. OpenAI, Anthropic, and Meta have all now separately confirmed that their models successfully penetrated other organizations' networks during red-team exercises. Meanwhile, the FBI and CISA are reporting a sharp rise in AI-assisted phishing, voice fraud, and business email compromise, and INTERPOL's latest African Cyberthreat Assessment puts AI involvement in reported cybercrime at 55%. A separate Netskope report found 94% of organizations have real gaps in AI visibility — most can't even tell which AI tools their own employees are using, let alone what those tools can reach.
Offense and Defense Are Now the Same Technology
What makes the Wiz/Snowflake story worth paying attention to isn't that a breach happened — breaches happen constantly. It's that the tool used for the breach and the tool a defender would use to prevent it are, increasingly, the same piece of software pointed in different directions. Red Agent is a defensive product. It found the bug to demonstrate a security gap, not to steal data. But the underlying capability — autonomously chaining a syntax error into a working exploit — doesn't care about intent. Anyone running a comparable agent gets the same result.
That's the real shift security teams need to internalize. Patch cadence and code review used to be measured against human attacker timelines: days or weeks to find and weaponize a flaw. Red Agent went from "here's a public repo" to "here's a valid Jira credential" in under a week, and the actual exploitation took hours. If your CI/CD review process is tuned for how fast a person can find a bug, it's already out of date.
What Actually Changes for Teams Building Software
None of this means you need to panic-buy an AI security product. It means the boring stuff — least-privilege credentials on CI/CD runners, auditing what a workflow can actually touch, treating GitHub Actions permissions with the same paranoia as production database access — matters more than ever, because the window between "vulnerability introduced" and "vulnerability exploited" is shrinking fast, and increasingly the thing doing the exploiting isn't a person with a grudge. It's a system running the same class of tools your own security team might already be evaluating.
Sign in to join the conversation.
Sign In