A headline blamed the AI. GitHub disputed it on the record. Here's what the vulnerability actually was.
FENCIO BRIEF · ISSUE 06
No, Copilot Didn't Write That Bug
Most of what we track is a genuine AI failure. This week's is a correction: a report on the Snowflake Jira breach got read as "Copilot wrote the vulnerability," and that version spread before GitHub pushed back on it directly.
THE BLIND SPOT
A human wrote the bug. An AI agent found it first.
An unescaped issue title in Snowflake's GitHub Actions workflow let shell commands run unchecked, written by a human engineer in an earlier commit. Copilot only entered the picture later, credited as co-author for unrelated formatting suggestions on a commit that got squashed together with everything else. GitHub has since confirmed, on the record, that it never touched the vulnerable line.
THIS WEEK'S ATTACK
Wiz's Red Agent Found the Bug Copilot Never Touched
Wiz Research's own autonomous agent, Red Agent, exploited a command-injection flaw in Snowflake's GitHub Actions workflow to steal an internal Jira token. The flaw was human-written, sitting there long before Red Agent found it.
CAUSE An unescaped issue title in a GitHub Actions workflow, written by a human engineer in a prior commit, that allowed shell command injection
TASK GIVEN Wiz's autonomous Red Agent, probing Snowflake's environment for exploitable weaknesses
ACTUALLY EXECUTED Found and exploited the injection flaw, using it to steal an internal Jira access token
WHAT CHANGED GitHub publicly disputed the early reporting that pinned the bug on Copilot Autofix. The vulnerability was human-written; the fastest-spreading detail about it wasn't true
A different failure shape, same underlying gap. At Meta, an engineer used an internal AI agent that had already cleared approval and review. It answered a technical question, then posted the answer, confidential data included, straight to a public internal forum. No misattribution to untangle, just a check that existed on paper and never ran in practice.
MCP servers, the protocol meant to give agents access to enterprise tools, are leaking secrets through plaintext configs and prompt injection, often before security teams even know the server is running.
CISA added an actively exploited remote code execution flaw in Ray, a distributed computing framework widely used for AI/ML workloads, to its known-exploited list.
Researchers showed Grok could be tricked, via a crafted web page it was asked to summarize, into exfiltrating a user's name, location, and live chat to an attacker-controlled server.
Reply and tell us: when a story blames "the AI," does your team check the source first? We read every one. And since an agent found what a human review missed this week, we've been building around that exact gap, more soon.
