It certified the bug — an AI review sign-off meets the new Product Liability Directive

Wiz Research disclosed on 17 August 2026 that its autonomous Red Agent found and exploited a GitHub Actions script injection in a public Snowflake repository five days after the change went live, reaching a token with read access to Snowflake's internal Jira. The headline in circulation calls it an Autofix bug; the merge record does not. Copilot Autofix's documented contribution to PR #1218 was a separate fix to jira_close.yml, while the injection sits in jira_issue.yml, where an issue title was interpolated straight into a shell run: step against GitHub's own hardening guidance. Copilot's role was to check the merged change and identify it as all-clear. What outlived the same-day patch is therefore a durable record asserting that a security review ran and found nothing - and from 9 December 2026, Directive (EU) 2024/2853 makes software a product, weighs safety-relevant cybersecurity requirements in the defectiveness test, lets a court order disclosure of relevant evidence once a claim is plausible, and presumes defectiveness where that evidence is not produced. Germany's transposing bill extends this expressly to manufacturers of AI systems.

Post

An AI reviewer checked the pull request and called it clean. Five days later an autonomous attacker was running commands on the CI runner.

Wiz Research published the write-up on 17 August. Their Red Agent — no human in the loop — found a GitHub Actions injection in a public Snowflake repository, exploited it, and lifted a token with read access to Snowflake's internal Jira.

PR 1218 merged 18 June. Live five days. Found and reported 23 June, patched the same day, token rotated on the 24th.

Now the correction, because the headline in circulation has it backwards.

This is not an Autofix bug. The merge record shows Copilot Autofix's documented contribution to that PR was a separate fix to jira_close.yml. The injection sits in jira_issue.yml, where an issue title was interpolated straight into a shell run: block, replacing a safer env-plus-jq pattern. Wiz's own words: Copilot "was a co-author that checked the merged PR and code change, and identified it as all-clear without noticing the critical vulnerabilities."

The machine did not write the vulnerability. It certified it.

Now the European part.

Directive (EU) 2024/2853 must be in national law by 9 December 2026 — 110 days out. Article 4(1): a product includes software. Article 7(2)(f) weighs "relevant product safety requirements, including safety-relevant cybersecurity requirements" when deciding whether a product was defective. Article 9(1) lets a court order you to disclose relevant evidence once a claim is plausible. Article 10(2)(a): fail to disclose, and defectiveness is presumed. Germany's transposing bill, Drucksache 21/4297, extends this expressly to manufacturers of AI systems.

The reasonable reading is a review miss, fixed inside a day — but what outlived the patch is a record asserting that a security review ran and found nothing.

What I'd do Monday:

  1. Treat pull request and review history as evidence with a retention policy, not as CI exhaust.
  2. Put a named human beside every agent sign-off, or stop calling it a review.
  3. Grep your workflows for github.event fields inside run: blocks. Move them into env.
  4. Record which automated checks ran on each merge, and what each one cleared.

Your agents are already filing evidence. Whose name is on it?

#AgenticAI #AIGovernance #AIEngineering #AppSec #Berlin

First comment

Sources, primary first —

Wiz Research, 17 August 2026 — the disclosure itself: Red Agent's autonomous discovery and exploitation, the payload, the Jira access and the forensics https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug

The pull request, snowflakedb/snowflake-connector-net #1218 — merged 18 June 2026, co-authored by Copilot Autofix, with the security review pointed at jira_close.yml. Read it before repeating the headline https://github.com/snowflakedb/snowflake-connector-net/pull/1218

Directive (EU) 2024/2853 on liability for defective products — Article 4(1) on software, Article 7(2) on defectiveness, Article 9 on disclosure, Article 10(2)(a) on the presumption https://eur-lex.europa.eu/eli/dir/2024/2853/oj/eng

Bundestag Drucksache 21/4297 — the German transposing bill, drafted to enter into force on 9 December 2026, with the rationale extending product liability to manufacturers of AI systems https://dserver.bundestag.de/btd/21/042/2104297.pdf

Bundestag press note — the first reading of that bill, 4 March 2026 https://www.bundestag.de/presse/hib/kurzmeldungen-1150966

GitHub's own hardening guidance — why an expression belongs in env and not in a run: block https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions

Faegre Drinker, 24 June 2026 — a member-state transposition scoreboard, if you need to know which of your markets will actually have this in force https://www.faegredrinker.com/en/insights/publications/2026/6/transposing-the-eus-new-product-liability-directive-a-member-state-progress-report

One point cut for length: this was a red-team finding, not a breach. No CVE was assigned, and Snowflake's forensics found no third-party access during the five-day window — worth remembering before anyone reaches for a notification clock. And on the German bill: I can confirm the first reading on 4 March and the drafted commencement date, not that it has been promulgated. Treat 9 December as the deadline the Directive sets, not as settled German law.

Claims

Sources

Corrections

The headline in circulation attributes this vulnerability to Copilot Autofix. The pull request itself does not support that: Autofix's documented contribution to PR #1218 was a separate fix to jira_close.yml, and the injection is in jira_issue.yml. Copilot's role on that PR was review, and it cleared the change. The distinction is carried in the edition rather than the claim being repeated. Two further points are handled with care: this was a red-team finding rather than a breach, with no CVE assigned and no third-party access found in the exposure window, so no notification clock is asserted; and for the German transposing bill the first reading of 4 March 2026 and the drafted commencement date are confirmed, promulgation is not, so 9 December is carried as the Directive's deadline rather than as settled German law. The GitHub REST API was unreachable from this environment, so the pull request was verified through its public web page instead.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.