Wiz published a case study on August 17, 2026 describing how its autonomous Red Agent discovered and exploited a GitHub Actions workflow-injection vulnerability in one of Snowflake's public repositories, snowflake-connector-net, without human intervention, five days after the vulnerable workflow reached the default branch. The flaw let an attacker submit a crafted GitHub issue that got expanded unsafely inside a workflow's shell command, allowing arbitrary command execution in a job that held internal Jira credentials; Wiz's agent independently found the bug, exploited it, validated that it could reach sensitive internal data, and assessed the blast radius, all autonomously. Notably, the underlying flaw had reportedly been reviewed by GitHub Copilot's automated code-scanning without being flagged, which is part of why Wiz is framing the finding as evidence that current AI-assisted code review tools can miss exactly the class of bug that AI-driven attackers are now capable of finding and weaponizing on their own. Wiz disclosed responsibly back in June and Snowflake fixed it the same day by replacing direct GitHub expression expansion with environment variables passed as arguments, and found no evidence of unauthorized access from a real attacker. The broader significance for engineering and security teams is less about this single repository and more about the trend line: offensive AI agents are becoming capable of end-to-end vulnerability discovery and exploitation in CI/CD pipelines at a pace that outstrips manual triage, which raises the bar for how quickly defensive tooling, including AI code review, needs to catch equivalent classes of injection bugs before agents like this one do.