AI agents are turning traditional cybersecurity on its head. Today, cloud security provider Wiz published a research blog claiming that Wiz Red Agent had autonomously discovered and exploited a GitHub Actions vulnerability in one of Snowflake’s public repositories.
According to Wiz, GitHub Copilot Autofix was allegedly a co-author that approved the code change without noticing the critical vulnerability. However, GitHub has conducted an internal review and states that the contributions leading to the vulnerability were authored by a human, and were not reviewed by or contributed to by Copilot.
In any case, the incident highlights how autonomous agents are becoming more effective at identifying and exploiting vulnerabilities. The vulnerability, disclosed as part of Snowflake’s HackerOne vulnerability disclosure platform and mitigated on June 23, enabled Wiz to obtain access to sensitive data in Snowflake’s internal Jira environment.
During the incident, the Wiz Red Agent used a script injection vulnerability in snowflakedb/snowflake-connector-net, which would allow an unauthenticated user to execute arbitrary commands within a GitHub actions runner by opening a GitHub issue with a specially crafted title.
The incident itself highlights how AI models are becoming capable of surfacing and exploiting vulnerabilities without human intervention, while also illustrating that defenders need to become more efficient at identifying vulnerabilities in the CI/CD pipeline.
The Dangers Of AI-Assisted Development
Wiz’s report comes amidst a wave of autonomous security incidents. Most notably, in July, OpenAI released a blog post claiming that GPT-5.6 Sol and a prerelease model had breached Hugging Face’s internal systems. The same month, Anthropic released its own post saying Claude had breached three organizations.
Then in August, the UK AI Security Institute shared a report detailing how Anthropic’s Mythos 5 took autonomous, unsanctioned actions on the internet in a training evaluation, targeting real people and organizations. This included trying to insert malicious code into an open-source project and engaging in social engineering.
It is becoming increasingly clear that autonomous attacks are a reality that defenders need to adapt to. As more companies implement coding agents in the software development lifecycle, security teams need to be prepared to mitigate vulnerabilities in both human-produced and AI-generated code before deploying to production.
Wiz’s findings highlight that enterprises must assume that threat actors will become proficient at identifying vulnerabilities over time. At the same time, Wiz demonstrates how defensive practices are evolving, with Red Agent becoming generally available in July, now supporting 40% of its customers and scanning millions of assets every month.
Gal Nagli, head of Offensive Security at Wiz, told me in a video interview that the “interesting part” about this incident was that “it was autonomously exploited and found by our AI. We didn’t need to intervene, which means frontier models already can exploit supply chain risks by themselves.”
Nagli also warned that defenders can’t trust AI code generation to be fully autonomous, or they could face additional risk. He also highlighted the need for proactive vulnerability scanning. “You have to use AI to attack yourself now because frontier models are so capable and so smart, and they can execute like autonomous experts end to end. So if you are not scanning yourself with AI, then you are already behind,” Nagli said.
Move Fast And Break Things
As organizations experiment with coding agents, the limits of the move fast and break things approach is being felt across the industry. “As developers increasingly rely on AI coding assistants, traditional security practices are becoming increasingly less effective,” Erik Avakian, technical counsellor at Info-Tech Research Group and former state CISO for the Commonwealth of Pennsylvania, told see via email.
For Avakian, cybersecurity is becoming an “AI-versus-AI battlefield,” where defensive tools identify vulnerabilities at the same speed as AI-assisted development can create them, while attackers develop autonomous systems to automate reconnaissance, discover vulnerabilities and generate exploits. Mitigating vulnerabilities is key to controlling risks on all sides.
However, vibe coding has the potential to amplify risk. “It’s super easy to code. So the attack surface has never been bigger,” Nagli said, adding that during their research, Wiz found a vibe-coded platform with a vulnerability that could be exploited to access every one of their private customers’ data.
It’s worth noting that the research comes less than a month after Wiz announced Project Atlas, a vulnerability scanning solution that uses multiple AI models to scan for vulnerabilities which outperformed Mythos on the CyberGym benchmark.
Updated 17 August 2026 to provide details about GitHub’s response to Wiz’s blog post.