CLAIM-2026-08-21-04

Copilot was a co-author that checked the merged PR and identified it as all-clear without noticing the critical vulnerabilities; Copilot Autofix's documented contribution to that PR was a separate fix to jira_close.yml, a different file from the one carrying the injection.

Sources

• wizresearch2026red
• githubsnowf2026snow