On June 18, Snowflake merged PR#1218 into their GitHub Actions pipeline. This pull request contained a vulnerability that exposed internal Jira credentials. During development, GitHub Copilot reviewed the code but flagged nothing. Five days later, Wiz's autonomous Red Agent tool identified the flaw, exploited it, and accessed Snowflake's internal Jira instance. Snowflake remediated the issue on June 23, the same day Wiz disclosed it.
This isn't about Snowflake's security posture. It's about the risks of assuming AI code review catches critical issues.
Timeline
June 18: PR#1218 merges into production, introducing a credential exposure vulnerability in Snowflake's GitHub Actions workflow. GitHub Copilot reviewed the code but didn't flag the issue.
June 18-23: The vulnerability remains live in Snowflake's pipeline for five days.
June 23: Wiz's Red Agent autonomously identifies and exploits the vulnerability, accessing Snowflake's internal Jira credentials. Wiz reports the finding to Snowflake.
June 23: Snowflake remediates the vulnerability.
Which Controls Failed
Code review process: The main failure was treating AI-assisted review as a security review. GitHub Copilot scanned the code and found nothing wrong, leading to the pull request's approval.
Secrets management: The workflow exposed credentials, indicating they weren't properly scoped or rotated, and the workflow didn't follow least-privilege principles.
Pre-production security testing: The code reached production without automated security scanning to catch credential exposure patterns. If Snowflake ran SAST or secrets detection tools in their CI/CD pipeline, they either didn't cover this pattern or the team ignored the findings.
Monitoring and detection: For five days, no internal system flagged the credential exposure or detected Red Agent's exploitation. The vulnerability was discovered through external testing, not internal controls.
What the Standards Require
PCI DSS v4.0.1 Requirement 6.3.2 mandates that security vulnerabilities are identified and addressed through a combination of automated tools and manual review. Automated tools alone aren't sufficient. Human review is needed for security-critical code, especially anything involving credentials or authentication.
OWASP ASVS v4.0.3 Section 14.2 covers build and deploy pipeline security. It requires that secrets never appear in code or configuration files, even temporarily. Requirement 14.2.3 states: "Verify that server configuration is hardened as per the recommendations of the application server and frameworks in use." GitHub Actions workflows count as server configuration.
ISO/IEC 27001:2022 Control 8.24 (secure coding) requires establishing and applying secure coding principles, including reviewing code for security issues before deployment. The control doesn't specify how you review, but it requires effectiveness. If your review process misses credential exposures, it's not effective.
NIST 800-53 Rev 5 SA-11 (developer testing and evaluation) requires security testing and evaluation throughout the development lifecycle. SA-11(1) adds static code analysis. SA-11(8) requires dynamic code analysis. They require verification that your testing actually finds vulnerabilities.
What This Means for Your Pipeline
Here's what failed: Snowflake treated AI code review as security review. GitHub Copilot is a development assistant. It catches syntax errors, suggests completions, and sometimes spots obvious bugs. It's not a security tool. You can't satisfy Requirement 6.3.2 by having Copilot look at your code.
Red Agent, on the other hand, is purpose-built for offensive security testing. It's designed to find and exploit vulnerabilities. That's why it succeeded where Copilot failed. They're solving different problems.
The lesson isn't "don't use AI for code review." It's "understand what your tools actually do." Copilot helps you write code faster. It doesn't replace security review. If you're treating it like a security gate, you're creating gaps.
Action Items for Your Team
Separate development assistance from security review: If you use GitHub Copilot, Tabnine, or similar tools, document what they do and don't check. Make it clear in your development process that AI code completion doesn't satisfy security review requirements. Update your pull request templates to require explicit security review for any code touching secrets, authentication, or authorization.
Add secrets detection to your CI/CD pipeline: Tools like GitGuardian, TruffleHog, or GitHub's own secret scanning should block commits that contain credentials. Configure them to run on every pull request before merge. Don't make these checks optional or easy to bypass.
Implement credential rotation for CI/CD workflows: Any credentials used in GitHub Actions, GitLab CI, or similar systems should rotate automatically. If a credential leaks, your rotation policy limits the exposure window. Snowflake's five-day window was five days too long.
Scope service accounts to minimum necessary access: The Jira credentials Red Agent accessed shouldn't have existed in the GitHub Actions workflow at all. Review every service account and API token in your CI/CD pipeline. Ask: Does this workflow actually need this access? Can we use a more limited scope? Can we eliminate the credential entirely through workload identity or similar mechanisms?
Test your security tools with offensive techniques: Red Agent found what Copilot missed because it actively tried to exploit the code. Add offensive security testing to your pipeline. This doesn't mean you need autonomous AI agents (though they're increasingly viable). It means running tools that simulate attacker behavior: DAST scanners, API fuzzers, credential stuffers.
Track your security review coverage: For every pull request that touches authentication, authorization, secrets management, or external integrations, log whether a human with security expertise reviewed it. If you're merging security-critical code without human review, you're gambling. The standards require human involvement for a reason.
The irony here is sharp: AI missed the vulnerability, AI found it, AI exploited it. That's not a failure of AI. It's a failure to understand what different AI tools are built to do. Copilot writes code with you. Red Agent attacks code against you. Use each for its actual purpose, and stop pretending development assistance equals security review.
