GitHub Copilot

Snowflake GitHub Actions Workflow Flaw Enabled Command Injection and Jira Token Theft

A vulnerability in Snowflake's GitHub Actions workflow in the snowflakedb/snowflake-connector-net repository allowed any user to execute arbitrary commands on a runner by creating a specially crafted issue in a public repository. The flaw stemmed from unsanitized insertion of issue titles and content directly into shell commands, combined with a failed access control check that relied on a non-existent pull request property during issue events. During authorized testing, an autonomous security agent exploited the issue to extract a Jira API token from the pipeline environment variables. This credential granted read access to internal engineering, security compliance, and bug bounty projects. The vulnerability was active from June 18 to June 23, 2026. Snowflake patched the workflow on the day the report was received and rotated the compromised token the following day. The vulnerable code appeared in a pull request that involved GitHub Copilot, though available history does not confirm the AI generated the insecure lines.

GitHub Copilot Traffic Analysis via MITM Proxy Exposes Prompt Context Handling and Local SQLite Session Storage

A detailed reverse-engineering study placed GitHub Copilot behind an mitmproxy instance to inspect all network requests made by Visual Studio Code. The analysis revealed that Copilot performs OAuth token exchange, model availability checks, and intent classification before any user input occurs. Prompts sent to the model include context from recently edited files, even when inline suggestions are disabled for sensitive extensions such as .env. Copilot maintains a local SQLite database named session-store.db that records every user prompt, LLM response, repository, and branch worked on. The extension also exposes a session_store_sql tool allowing the model to run read-only SQL queries against this history using the Copilot Chronicle skill. These findings highlight how AI coding assistants manage context, authentication, and persistent local state.

Prompt Injection Emerges as Top Risk for LLM Applications in Production

Prompt injection attacks are moving from theoretical demonstrations to real-world exploits targeting AI assistants in enterprise environments. Attackers embed malicious instructions in emails, documents, and code comments that override developer rules when models process untrusted input. Incidents involving Microsoft 365 Copilot, GitHub Copilot, and Cursor have shown data exfiltration and remote code execution risks with severity scores above 9.0. The core issue stems from the lack of strict boundaries between trusted system prompts and untrusted external content fed into large language models. Defenses require layered controls including code-enforced permissions, input filtering, human confirmation for high-risk actions, and explicit marking of external data. Major vendors including OpenAI, Anthropic, and Google acknowledge that no single static defense can fully eliminate the threat. OWASP ranks prompt injection as the leading risk for LLM applications, urging organizations to treat AI agents as systems with untrusted inputs.

From Hundreds of Alerts to Proven Vulnerabilities: INFERA AI.SafeCode Unifies Seven Scanners into a Single DevSecOps Pipeline

INFERA AI.SafeCode integrates seven distinct security scanners into one continuous analysis platform that automatically validates findings instead of flooding teams with unconfirmed alerts. The solution combines SAST, SCA, Secrets detection, DAST, AI-driven Pentest agents, Code Fuzzing, and API Fuzzing to deliver proof-of-exploit evidence for high-risk issues. By cross-validating results across engines, the platform reduces false positives and provides developers with actionable tasks that include reproduction steps, stack traces, and one-click AutoFix recommendations directly inside IDEs and Git workflows. Special attention is given to AI-generated code from tools such as GitHub Copilot, Cursor, and Claude, ensuring that rapid development does not introduce unvetted vulnerabilities. The system also maps full attack surfaces, tracks reachability from entry points to vulnerable sinks, and supports compliance requirements including FSTEC orders for critical information infrastructure. MLSecOps capabilities extend coverage to machine-learning pipelines, model configurations, and inference APIs. Overall, INFERA shifts AppSec from reactive alert triage to measurable risk management with clear MTTR metrics and SLA tracking.