GitHub issue title let an AI agent hijack Snowflake CI and steal a token

Researchers at Wiz found that a public Snowflake code repository could be hijacked through nothing more than a crafted GitHub issue title. A workflow that ran when issues were opened dropped the attacker-controlled title straight into a command, so an unauthenticated user could run code on the GitHub Actions runner and steal a Jira API token used by the automation. The notable twist is how the bug arrived: it was introduced days earlier by an AI tool meant to fix security issues, and an AI code reviewer approved the change. Snowflake fixed it by passing the title safely as an argument rather than expanding it into a command.

Check

Audit GitHub Actions workflows that run on untrusted input like issue titles or pull requests, and never interpolate that input directly into shell commands; pass it as environment variables or arguments.

Affected

Repositories whose workflows trigger on issues or pull requests and interpolate attacker-controlled text into commands; an unauthenticated user can run code on the runner and steal the secrets the workflow holds.

Fix

Sanitize untrusted workflow input, minimize the secrets and permissions each workflow can access, and do not assume AI-generated or AI-reviewed code is safe, since automated fixes and reviews miss injection flaws.