EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Aug 17·5 min read
AI-Generated GitHub Copilot "Autofix" Allowed Compromise of Snowflake's Jira
TL;DR
Wiz Red Agent exploited a vulnerability in GitHub Actions, introduced by GitHub Copilot Autofix, allowing access to sensitive data in Snowflake's internal Jira. This incident underscores the risks of AI coding assistants in software development.
✦ Why It Matters
Review your use of AI coding assistants to ensure they do not introduce vulnerabilities.
Key Takeaways
- Ensure AI-generated code undergoes thorough security reviews.
- Implement guardrails to prevent unsafe code patterns from AI tools.
- Monitor automated discovery of vulnerabilities for rapid response.
- Rotate credentials regularly to minimize exposure risks.
How It Works
Wiz Red Agent scanned Snowflake's GitHub organization and identified a vulnerability in the jira_issue.yml workflow. The flaw allowed an attacker to execute arbitrary commands by manipulating the issue title, which was directly interpolated into a shell script without proper sanitization.
This oversight was due to an AI-generated commit that replaced a safe input handling method with a risky direct string expansion.