Wiz Red Agent評測：AI代理自主駭入Snowflake系統 | Wiz Red Agent Review: AI Agent Hacks Snowflake Alone
By Kit 小克 | AI Tool Observer | 2026-08-23
🇹🇼 Wiz Red Agent評測：AI代理自主駭入Snowflake系統
Wiz Red Agent 是資安新創 Wiz 打造的自主 AI 滲透測試代理，2026 年 8 月的一場實測中，它在沒有人類即時介入的情況下，自己掃描出 Snowflake 官方 GitHub repo 裡的一個漏洞，還自己把它打通、拿到內部 Jira 系統的憑證。更引起討論的是：這個漏洞連 GitHub Copilot 的程式碼審查都沒抓到。
什麼是 Wiz Red Agent？
Wiz Red Agent 是 Wiz 內部用來做自動化紅隊演練的 AI 代理，專門掃描客戶或自家 GitHub 組織的 CI/CD 設定，找出可被利用的漏洞並嘗試實際攻擊，驗證漏洞是否「真的能打」而不只是理論風險。
Wiz Red Agent 怎麼攻陷 Snowflake 的？
問題出在 snowflake-connector-net 這個 repo 的 GitHub Actions 設定，一段合併於 2026 年 6 月 18 日的 PR 讓 GitHub Issue 標題可以被直接餵進 shell 指令。Wiz Red Agent 自主掃描 Snowflake 的 GitHub 組織後鎖定這個弱點，開了一個 Issue，把標題設計成能跳脫 shell 的 echo 語句、注入惡意指令。第一次嘗試因為語法錯誤失敗，但代理自己分析錯誤訊息、修改 payload，第二次就成功把內部 Jira 的憑證外洩到自己控制的伺服器。整個過程只花了漏洞上線後的五天。
為什麼比 GitHub Copilot 更早發現漏洞？
這起事件一度引發「Copilot 也參與寫了這段有問題的程式碼」的爭議，GitHub 官方後來澄清，該段程式碼是人類作者撰寫、未經 Copilot 審查或貢獻。真正的重點其實不是 Copilot 的鍋，而是AI agent 做安全掃描的效率已經超越傳統靜態分析工具——Wiz Red Agent 能像真正的攻擊者一樣「試錯」，這是規則式掃描器做不到的。
開發者該注意什麼？
- GitHub Actions 的 Issue 標題、PR 標題等使用者輸入絕對不要直接餵進 shell 指令，一定要用環境變數傳遞
- CI/CD 憑證應該用最小權限原則，避免一個 workflow 洩漏就牽連整個內部系統
- 如果你的組織還沒被 AI agent 掃過一輪，代表攻擊者可能已經搶先一步
常見問題 FAQ
Q: Wiz Red Agent 是攻擊工具還是防禦工具？
A: 是 Wiz 內部的紅隊測試工具，用來替客戶主動找漏洞，屬於防禦性資安應用，但技術上和真實攻擊者的手法完全相同。
Q: 這件事跟 GitHub Copilot 有關嗎？
A: GitHub 官方澄清該段有問題的程式碼是人類撰寫，Copilot 沒有參與審查或貢獻，先前的說法是誤傳。
Q: 一般開發團隊該怎麼防範類似漏洞？
A: 避免把使用者可控的字串（如 Issue 標題）直接插入 shell 指令，並定期用自動化工具掃描 CI/CD 設定檔。
好不好用，試了才知道。
🇺🇸 Wiz Red Agent Review: AI Agent Hacks Snowflake Alone
Wiz Red Agent is an autonomous AI pentesting agent built by security startup Wiz. In a real-world run in August 2026, it scanned Snowflake's public GitHub repo, found an exploitable flaw with zero human intervention, and successfully attacked it to steal internal Jira credentials — a vulnerability that had slipped past GitHub Copilot's code review entirely.
What Is Wiz Red Agent?
Wiz Red Agent is an AI-driven red-team tool Wiz uses internally to automate offensive security testing. It scans a target's GitHub organization and CI/CD configuration for exploitable weaknesses, then actually attempts to exploit them to confirm the risk is real, not just theoretical.
How Did It Hack Snowflake?
The bug lived in a GitHub Actions workflow in the snowflake-connector-net repo, introduced by a PR merged on June 18, 2026. The workflow fed GitHub issue titles directly into a shell command. Wiz Red Agent scanned Snowflake's org, spotted the pattern, and opened an issue with a title crafted to break out of the shell's echo statement and inject malicious commands. Its first attempt failed on a syntax error — but the agent analyzed the failure, rewrote the payload, and succeeded on the second try, exfiltrating internal Jira credentials to a server it controlled. All within five days of the bug going live.
Why Did It Beat GitHub Copilot to the Find?
The incident briefly sparked claims that GitHub Copilot had co-authored the vulnerable code. GitHub later clarified the code was written entirely by a human and never touched Copilot's review. The real story isn't about blaming Copilot — it's that an AI agent doing security scanning can now out-perform static analysis tools, because it can iterate on failed exploit attempts the way a real attacker would, not just pattern-match known rules.
What Should Developers Watch For?
- Never feed user-controlled input — like GitHub issue or PR titles — directly into shell commands in Actions workflows; pass them through environment variables instead
- Apply least-privilege to CI/CD credentials so one leaked workflow token can't reach your whole internal stack
- If your org hasn't been scanned by an AI agent yet, assume an attacker's version already has
FAQ
Q: Is Wiz Red Agent an attack tool or a defense tool?
A: It's Wiz's internal red-team tool used to proactively find flaws for customers — defensive in intent, but technically identical to a real attacker's methodology.
Q: Was GitHub Copilot actually involved?
A: No. GitHub confirmed the vulnerable code was human-written and never reviewed or contributed to by Copilot — earlier reports conflating the two were inaccurate.
Q: How can teams prevent similar bugs?
A: Never interpolate user-controlled strings like issue titles directly into shell commands, and regularly scan CI/CD configs with automated tools.
好不好用，試了才知道。
Sources / 資料來源
- Wiz Blog: Red Agent Exploits Snowflake Vuln Missed by GitHub Copilot
- The Hacker News: Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection
- Forbes: Wiz's AI Agent Finds A Vulnerability In Snowflake's Internal Systems
常見問題 FAQ
Wiz Red Agent 是攻擊工具還是防禦工具？
是 Wiz 內部紅隊測試工具，用於防禦性主動找漏洞，但技術手法與真實攻擊者相同。
這件事跟 GitHub Copilot 有關嗎？
GitHub 官方澄清有問題的程式碼由人類撰寫，Copilot 未參與審查或貢獻。
開發團隊該怎麼防範類似漏洞？
避免將使用者可控字串直接插入 shell 指令，並定期掃描 CI/CD 設定檔。
延伸閱讀 / Related Articles
- Qwen3.8-Max評測：2.4兆參數開源模型直逼Claude | Qwen3.8-Max Review: 2.4T-Param Open Model Rivals Claude
- Claude蛋白質設計評測：命中率是業界2倍 | Claude Protein Design Review: 2x Industry Hit Rate
- Android AI Agent漏洞評測：隱形文字劫持手機代理入侵電腦 | Android AI Agent Review: Invisible Text Hijacks Phone Bots
AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends
留言
張貼留言