{
  "Event": {
    "uuid": "8054a04c-0101-47a5-87ea-af817815647f",
    "info": "One Untrusted String, Three Trust Boundaries — Optimus Labs · Civilizations",
    "date": "2026-08-17",
    "threat_level_id": "1",
    "analysis": "2",
    "published": true,
    "Orgc": {
      "name": "Optimus Labs · Civilizations"
    },
    "Tag": [
      {
        "name": "optimus:briefing=\"wiz-red-agent-snowflake-trust-boundaries\""
      },
      {
        "name": "optimus:severity=\"high\""
      },
      {
        "name": "optimus:type=\"rogue-ai\""
      },
      {
        "name": "optimus:type=\"coding-agent\""
      },
      {
        "name": "optimus:type=\"supply-chain\""
      },
      {
        "name": "optimus:category=\"AI\""
      },
      {
        "name": "optimus:category=\"AL\""
      },
      {
        "name": "optimus:category=\"AP\""
      },
      {
        "name": "optimus:category=\"OL\""
      },
      {
        "name": "type:OSINT"
      }
    ],
    "Attribute": [
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.optimuslabs.io/research/briefings/wiz-red-agent-snowflake-trust-boundaries",
        "comment": "Optimus Labs briefing"
      },
      {
        "type": "domain",
        "category": "Network activity",
        "to_ids": true,
        "value": "github.com",
        "comment": "Repo: github.com/snowf1akedb/snowf1ake-connector-net"
      },
      {
        "type": "filename",
        "category": "Payload delivery",
        "to_ids": false,
        "value": "jira_issue.yml",
        "comment": "Workflow: jira_issue.yml (`run:` step interpolating the issue title)"
      },
      {
        "type": "email",
        "category": "Payload delivery",
        "to_ids": false,
        "value": "qa@snowflake.net",
        "comment": "Replayed identity: qa@snowflake.net"
      },
      {
        "type": "domain",
        "category": "Network activity",
        "to_ids": true,
        "value": "snowflake.net",
        "comment": "Replayed identity: qa@snowflake.net"
      }
    ]
  }
}