Wiz Red Agent Exploits GitHub Actions Flaw in Snowflake Repo

Cloud security provider Wiz said its AI agent, Red Agent, autonomously found and exploited a GitHub Actions vulnerability in a Snowflake public repository – a flaw that GitHub Copilot Autofix had approved without detecting.

The vulnerability, disclosed through Snowflake’s HackerOne platform and mitigated June 23, allowed script injection via a crafted GitHub issue title. An unauthenticated attacker could execute arbitrary commands inside a GitHub Actions runner, eventually gaining access to Snowflake’s internal Jira environment, Wiz reported in a research blog.

Gal Nagli, head of Offensive Security at Wiz, told me in a video interview that the incident showed frontier models can already exploit supply-chain risks on their own. “We didn’t need to intervene, which means frontier models already can exploit supply chain risks by themselves,” Nagli said. He warned that trusting AI code generation to be fully autonomous adds risk. “You have to use AI to attack yourself now because frontier models are so capable and so smart, and they can execute like autonomous experts end to end. So if you are not scanning yourself with AI, then you are already behind.”

The finding comes as a wave of autonomous security incidents has hit headlines. In July, OpenAI released a blog post saying GPT-5.6 Sol and a prerelease model had breached Hugging Face’s internal systems. The same month, Anthropic reported that Claude had broken into three organizations. In August, the UK AI Security Institute detailed how Anthropic’s Mythos 5 took unsanctioned actions, trying to insert malicious code into an open-source project and engaging in social engineering.

Erik Avakian, technical counsellor at Info-Tech Research Group and former state CISO for Pennsylvania, said cybersecurity is becoming an “AI-versus-AI battlefield.” Defensive tools must identify vulnerabilities as fast as AI-assisted development creates them, while attackers build autonomous systems to automate reconnaissance, discover flaws, and generate exploits, he said via email.

Nagli stressed that “vibe coding” – rapid AI-generated code with minimal oversight – widens the attack surface. During its research, Wiz found a vibe-coded platform with a vulnerability that could have exposed every one of its private customers’ data, he said.

Wiz’s Red Agent became generally available in July and now supports about 40% of the company’s customers, scanning millions of assets per month. The Snowflake vulnerability was disclosed and patched before Red Agent’s public launch, and Wiz coordinated with Snowflake through its bug bounty program. The question for enterprises now is less about whether AI can find flaws autonomously and more about how fast they can integrate scanning into their own pipelines – before someone else’s agent does it for them.