Quirin Schlegel

Loading

It certified the bug — an AI review sign-off meets the new Product Liability Directive

Wiz Research disclosed on 17 August 2026 that its autonomous Red Agent found and exploited a GitHub Actions script injection in a public Snowflake repository five days after the change went live, reaching a token with read access to Snowflake's internal Jira. The headline in circulation calls it an Autofix bug; the merge record does not. Copilot Autofix's documented contribution to PR #1218 was a separate fix to jira_close.yml, while the injection sits in jira_issue.yml, where an issue title was interpolated straight into a shell run: step against GitHub's own hardening guidance. Copilot's role was to check the merged change and identify it as all-clear. What outlived the same-day patch is therefore a durable record asserting that a security review ran and found nothing - and from 9 December 2026, Directive (EU) 2024/2853 makes software a product, weighs safety-relevant cybersecurity requirements in the defectiveness test, lets a court order disclosure of relevant evidence once a claim is plausible, and presumes defectiveness where that evidence is not produced. Germany's transposing bill extends this expressly to manufacturers of AI systems.

21 August 202611 verified claims7 sources

An AI reviewer checked the pull request and called it clean. Five days later an autonomous attacker was running commands on the CI runner.

Wiz Research published the write-up on 17 August. Their Red Agent — no human in the loop — found a GitHub Actions injection in a public Snowflake repository, exploited it, and lifted a token with read access to Snowflake's internal Jira.

PR 1218 merged 18 June. Live five days. Found and reported 23 June, patched the same day, token rotated on the 24th.

Now the correction, because the headline in circulation has it backwards.

This is not an Autofix bug. The merge record shows Copilot Autofix's documented contribution to that PR was a separate fix to jira_close.yml. The injection sits in jira_issue.yml, where an issue title was interpolated straight into a shell run: block, replacing a safer env-plus-jq pattern. Wiz's own words: Copilot "was a co-author that checked the merged PR and code change, and identified it as all-clear without noticing the critical vulnerabilities."

The machine did not write the vulnerability. It certified it.

Now the European part.

Directive (EU) 2024/2853 must be in national law by 9 December 2026 — 110 days out. Article 4(1): a product includes software. Article 7(2)(f) weighs "relevant product safety requirements, including safety-relevant cybersecurity requirements" when deciding whether a product was defective. Article 9(1) lets a court order you to disclose relevant evidence once a claim is plausible. Article 10(2)(a): fail to disclose, and defectiveness is presumed. Germany's transposing bill, Drucksache 21/4297, extends this expressly to manufacturers of AI systems.

The reasonable reading is a review miss, fixed inside a day — but what outlived the patch is a record asserting that a security review ran and found nothing.

What I'd do Monday:

1. Treat pull request and review history as evidence with a retention policy, not as CI exhaust. 2. Put a named human beside every agent sign-off, or stop calling it a review. 3. Grep your workflows for github.event fields inside run: blocks. Move them into env. 4. Record which automated checks ran on each merge, and what each one cleared.

Your agents are already filing evidence. Whose name is on it?

#AgenticAI #AIGovernance #AIEngineering #AppSec #Berlin

Evidence

What this rests on

Every factual claim in the edition above, stated on its own and checked before publication. If one of these is wrong, the argument is wrong — so they are listed where you can check them.

Wiz Research published on 17 August 2026 that its autonomous Red Agent discovered and exploited a GitHub Actions script-injection vulnerability in a public Snowflake repository without human intervention, five days after the flaw became live.
Why it matters
wizresearch2026red
The vulnerability was in .github/workflows/jira_issue.yml, where the GitHub issue title expression was interpolated directly into a shell run: step, allowing command injection via a crafted issue title.
Why it matters
wizresearch2026red · githubsnowf2026snow
The vulnerability was introduced by PR #1218 ('SNOW-2069227 : Update jira workflows') in snowflakedb/snowflake-connector-net, merged on 18 June 2026 as commit 4a1b8ce.
Why it matters
wizresearch2026red · githubsnowf2026snow
Copilot was a co-author that checked the merged PR and identified it as all-clear without noticing the critical vulnerabilities; Copilot Autofix's documented contribution to that PR was a separate fix to jira_close.yml, a different file from the one carrying the injection.
Why it matters
wizresearch2026red · githubsnowf2026snow
Wiz reported the issue on 23 June 2026; Snowflake patched the workflow the same day (commit 1dc7766, PR #1402) and rotated the exposed Jira token on 24 June 2026. Forensic analysis found no external third-party access during the five-day exposure window.
Why it matters
wizresearch2026red
Directive (EU) 2024/2853 Article 4(1) defines 'product' as all movables and expressly includes electricity, digital manufacturing files, raw materials and software.
Why it matters
eurlex2024directive
Directive (EU) 2024/2853 Article 7(2)(f) requires that, in assessing defectiveness, account be taken of relevant product safety requirements, including safety-relevant cybersecurity requirements; Article 7(2)(c) covers the effect of any ability of the product to continue to learn or acquire new features after being placed on the market.
Why it matters
eurlex2024directive
Directive (EU) 2024/2853 Article 9(1) allows a court to order a defendant to disclose relevant evidence once the claimant has presented facts and evidence sufficient to support the plausibility of the claim, and Article 10(2)(a) presumes the defectiveness of the product where the defendant fails to disclose that evidence.
Why it matters
eurlex2024directive
Directive (EU) 2024/2853 must be transposed by member states by 9 December 2026, and the national measures apply to products placed on the market on or after that date; the Directive entered into force on 8 December 2024.
Why it matters
eurlex2024directive · faegredrink2026transposi
Germany's transposing bill, the Gesetz zur Modernisierung des Produkthaftungsrechts (Bundestag Drucksache 21/4297), had its first reading on 4 March 2026 and is drafted to enter into force on 9 December 2026; its rationale states that product liability law is thereby extended to manufacturers of artificial intelligence systems, while excluding open-source software developed or supplied outside a commercial activity.
Why it matters
deutscherbu2026entwurf · deutscherbu2026produktha
GitHub's own security hardening guidance states that for inline scripts the preferred approach to handling untrusted input is to set the value of the expression to an intermediate environment variable.
Why it matters
githubdocs2026security

Sources

Every source for this edition, as one PDF BibTeX — all editions

Corrections

What changed after publication

The headline in circulation attributes this vulnerability to Copilot Autofix. The pull request itself does not support that: Autofix's documented contribution to PR #1218 was a separate fix to jira_close.yml, and the injection is in jira_issue.yml. Copilot's role on that PR was review, and it cleared the change. The distinction is carried in the edition rather than the claim being repeated. Two further points are handled with care: this was a red-team finding rather than a breach, with no CVE assigned and no third-party access found in the exposure window, so no notification clock is asserted; and for the German transposing bill the first reading of 4 March 2026 and the drafted commencement date are confirmed, promulgation is not, so 9 December is carried as the Directive's deadline rather than as settled German law. The GitHub REST API was unreachable from this environment, so the pull request was verified through its public web page instead.