An AI broke Snowflake's code. Then another AI agent exploited it

{
  "signal_id": "dc638197-e4aa-55c7-766d-b3e87d8eb52a",
  "signal_type": "news",
  "signal_subtype": "partners_with",
  "detected_at": "2026-08-17T16:36:21+00:00",
  "company": {
    "name": "Snowflake",
    "domain": "snowflake.com"
  },
  "data": {
    "url": "https://www.theregister.com/security/2026/08/17/an-ai-broke-snowflakes-code-then-another-ai-agent-exploited-it/5288666",
    "title": "An AI broke Snowflake's code. Then another AI agent exploited it",
    "excerpt": "Security Don't worry, this one was via a bug bounty program An AI broke Snowflake’s code; then another AI, an attack agent, autonomously found the bug, exploited it, and extracted credentials without human intervention. Luckily, this wasn’t yet another case of rogue AI agents doing evil things . It was a sanctioned bug hunt, conducted through Snowflake’s HackerOne vulnerability disclosure program, and Snowflake fixed the flaw the same day Wiz reported it and rotated the affected credentials the following day. Wiz’s red agent , an AI-powered autonomous attacker designed for offensive security, found the GitHub Actions workflow flaw during a routine scan of public repositories on June 23. The script injection vulnerability existed in snowflakedb/snowflake-connector-net , and it allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner by opening a GitHub issue with a specially crafted title. And it turned out an AI had inadvertently injected the bug into the code five days earlier. GitHub Copilot Autofix, an AI coding assistant, co-authored the commit on June 18, and it introduced a script injection bug in run: blocks by removing the repository’s existing sanitized input pattern and replacing it with direct string expansion in a shell script. “We crafted an issue title that, after template expansion, breaks out of the echo string and...",
    "summary": "Snowflake is collaborating with security firm Wiz to share learnings from a recent vulnerability disclosure with the broader industry.",
    "planning": false,
    "image_url": "https://image.theregister.com/5288720.jpg?imageId=5288720&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683",
    "confidence": 0.9,
    "published_at": "2026-08-17T16:36:21Z",
    "article_sentence": "“We are working together with Wiz to share these learnings with the broader industry to encourage widespread adoption of these security best practices.”",
    "related_company_name": "Wiz",
    "related_company_domain": "wiz.io"
  }
}

curl https://signals.autobound.ai/v1/signals/dc638197-e4aa-55c7-766d-b3e87d8eb52a \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"snowflake.com","limit":20}'