What's this about?
Wiz Research's "Red Agent" — an autonomous, AI-powered security research tool — was working through Snowflake's HackerOne disclosure program when it found a critical GitHub Actions vulnerability in one of Snowflake's public repositories and used it to reach Snowflake's internal Jira. The flaw entered through a Copilot-assisted pull request. Two mistakes stacked: a single quote in an issue title broke out of an `echo '...'` command and allowed arbitrary command execution, and the workflow's apparently protective `if:` condition was meaningless because `github.event.pull_request` is always null on `issues` events. Snowflake fixed it the same day, rotated the exposed credential, and confirmed from audit logs that Wiz was the only actor during the window.
What exactly is a GitHub Actions injection?
GitHub Actions runs scripts automatically when things happen in your repository — someone opens an issue, pushes a commit. Those scripts often interpolate content from the event into a shell command, such as echoing the issue title into a log. But an issue title is text a stranger controls. If it contains a quote character, it can terminate the string the script intended and everything after becomes a command the runner executes — with whatever credentials that workflow holds. It's the same shape as SQL injection: data crossing into the command position. The uncomfortable part is that this is a very old, very well-understood bug class.
What's the community saying?
- "Quote injection still alive and well in 2026." The most-upvoted reaction was weary recognition — this is a decades-old vulnerability class, produced fresh by a modern tool.
- The dead `if:` condition drew more scorn than the injection. Commenters pointed out that the guard checked `github.event.pull_request.user.login` on an `issues` event, where that object is always null — so the condition never protected anything, and wouldn't have even if the author's mental model had been right.
- A pointed reassignment of blame. "No, Snowflake allowing autofixes compromised their Jira. If you tell someone to shoot you in the foot, and they shoot you in the foot, you shot yourself in the foot, just with more steps."
- "Peer review of changes is still important." The short version of the lesson, and the direct link to the argument that has run all month about whether AI-authored PRs get read.
- What the change was trying to do makes it worse. Someone looked up the originating PR: it was cleaning up deprecated Jira actions and reducing complexity — a tidy-up, exactly the low-risk category people are most willing to merge without close reading.