AI Security Battle: Copilot Autofix & Snowflake Breach

An entirely AI-driven security battle recently unfolded in Snowflake's public code repository. An autonomous red team agent from Wiz Research successfully exploited a vulnerability to penetrate Snowflake's internal Jira instance. Here's the thing: this vulnerability was partially introduced by GitHub Copilot Autofix. The entire attack involved no human participation, and an AI code-fixing tool directly led to the vulnerability's introduction. The red agent created an Issue with shell commands in the title, which then executed on the GitHub Actions runner. This allowed the agent to extract a GitHub token and ultimately gain access to the Jira instance. The agent even analyzed error messages and adjusted its attack payload independently. What's interesting is the controversy over who is responsible. Wiz initially stated the code was "co-authored by Copilot Autofix powered by AI." However, GitHub pushed back, noting the vulnerable code originated from a commit attributed to a named Snowflake engineer. The bottom line is this shows the complex and evolving nature of AI in cybersecurity, both in creating and exploiting vulnerabilities.