THE 60-SECOND VERSION
● Wiz Red Agent found, exploited and assessed the blast radius of a GitHub Actions injection with no human involved — five days after the flaw went live.
● The dispute: Wiz says Copilot reviewed the change and cleared it. GitHub says Copilot never reviewed it. Both cannot be true.
● OpenAI shipped a teen ChatGPT for 13 to 17 year olds, with age prediction that auto-routes minors into it.
● 12 days left on Claude Sonnet 5 at 2 dollars per million input.
An autonomous agent ran the whole attack chain
Wiz Research operates an autonomous security tool called Red Agent. Working through Snowflake's HackerOne programme, it scanned the company's GitHub organisation and flagged a workflow file, jira_issue.yml, in the public snowflakedb/snowflake-connector-net repository as vulnerable to script injection through untrusted input in a run block.
What happened next is the part worth sitting with. The agent independently discovered the flaw, wrote an exploit, adapted when its first payload threw a shell syntax error, exfiltrated a Jira token, validated access to internal Snowflake projects, and assessed the blast radius — all without human intervention.
THE TIMELINE
June 18, 2026 — PR #1218 merged. The vulnerability goes live.
June 23, 2026 — Wiz Red Agent finds and exploits it. Five days.
Same day — reported to Snowflake, which says it investigated and remediated immediately and found no evidence of unauthorised access.
August 17, 2026 — Wiz publishes. Gal Nagli, head of threat exposure at Wiz Research, is the named author.
An unauthenticated attacker could execute arbitrary commands in a GitHub Actions runner by opening an issue with a crafted title. The exfiltrated token carried read access to engineering, security compliance and bug bounty projects.
The dispute nobody can settle from outside
The merge commit lists Copilot Autofix powered by AI among its co-authors, and Wiz's original post read that as an AI having written the vulnerable code. Most coverage followed.
Then people read the underlying commits. Copilot's explicit co-authored commit changed a different file. The unsafe refactor sits in a separate commit dated August 2025, which GitHub attributes to a named Snowflake engineer. Squash merges fold every commit in a pull request into one, and the co-author line comes along for the ride — it records participation in the pull request, not authorship of the broken lines.
Wiz updated its post on August 17 at 19:57 UTC to say Copilot was a co-author that checked the merged change and marked it all-clear, and that whether the code change itself was AI-assisted is unclear.
That leaves one question that actually matters, and it is unresolved: did GitHub's AI review look at this change and pass it? Wiz says yes. GitHub says Copilot Autofix never reviewed the code at all. Only one of those companies holds the logs that would prove it.
No CVE was assigned. No CVSS score, no entry in the US exploited-vulnerabilities catalogue. The weakness sat in repository automation, so no shipped connector release carried it. Full breakdown of the mechanism and the attribution fight here.
OpenAI shipped a teen ChatGPT
Launched Tuesday, August 18, for users aged 13 to 17. It blocks conversations involving self-harm and romantic or sexual content, and uses age prediction to route suspected minors into the mode automatically rather than relying on self-declared birthdates.
Parents get quiet hours and notifications on high-risk safety events. A study mode nudges students toward working through problems rather than requesting finished answers.
The age-prediction piece is the consequential design choice. It shifts the burden from a checkbox a teenager can lie past to an inference the platform makes, which is more effective and also a larger surface for getting it wrong in both directions. We covered what changes in practice separately.
An LLM manager recommended firing someone
Andon Labs runs an AI store manager called Luna, built on Claude Sonnet 4.6, operating Andon Market in San Francisco. Luna recommended dismissing a human employee after 17 no-shows across 23 shifts — the first known termination decision by an LLM manager.
The detail that reframes it: store logs show Luna had lost track of its own attendance policy for months and only raised termination after a human supervisor prompted it to check the employee handbook. This was not an autonomous judgement. It was a correct conclusion reached only once a person pointed the model at the relevant document.
All Andon workers remain formally employed by Andon Labs, which preserves the legal protections that would otherwise be in question here.
Also moving
- Baidu Q2: AI Cloud Infrastructure up 50 percent year on year to RMB 7.3 billion, with GPU Cloud revenue up 283 percent, accelerating from 184 percent in Q1. CEO Robin Li said AI-powered business now accounts for half of Baidu's General Business at RMB 12.5 billion.
- Alipay unveiled a full-stack agentic commerce platform at a Hangzhou partner conference on August 18, letting merchants convert pages, products and workflows into agent-ready skills and MCP tools, wired into its consumer agent through an interoperability protocol. KFC and Luckin Coffee are among the named partners.
Deadlines still running
| Date |
What happens |
| Aug 31 |
Claude Sonnet 5 moves 2 to 3 dollars per million input, plus a tokenizer change adding 10 to 35 percent tokens on code |
| Aug 31 |
kimi-k2.5 and moonshot-v1 sunset, migrate to kimi-k3 |
| Early-mid Sept |
Grok 4.7 window per Musk. No model ID at docs.x.ai yet |
| Oct 1 |
OpenAI vs Apple hearing |
| Oct 24 |
deepseek-chat and deepseek-reasoner deprecated |
What we are watching next
Whether GitHub or Wiz publishes the logs. One of them can end this in an afternoon, and the fact that neither has yet is itself informative.
The broader shift is the one to internalise: an autonomous agent went from scan to validated exploit to blast-radius assessment in a window measured in days, against a flaw that a commercial AI scanner either missed or never saw. Whichever version is true, the defensive tooling did not catch what the offensive tooling found.
FAQ
Did GitHub Copilot write the vulnerable code?
Unproven. The merge commit lists Copilot Autofix as a co-author, but commit history shows Copilot's explicit change touched a different file, and the unsafe refactor is attributed to a named engineer in a 2025 commit. Squash merges carry co-author lines forward regardless of which lines each author touched.
Was any customer data exposed?
Per Snowflake, no evidence of unauthorised access was found, and the flaw sat in repository automation rather than in any shipped connector release. The exfiltrated token reached internal Jira projects during authorised testing by Wiz.
Is there a CVE for this?
No. No CVE, no CVSS score, and no entry in the US catalogue of known exploited vulnerabilities.
What is the teen ChatGPT age prediction doing?
Inferring whether a user is likely a minor and routing them into the restricted mode automatically, rather than trusting a self-reported birthdate. Parents can set quiet hours and receive notifications on high-risk safety events.
Did an AI actually fire someone?
It recommended dismissal. Luna, running on Claude Sonnet 4.6, raised it after 17 no-shows in 23 shifts, and only after a human supervisor prompted it to consult the employee handbook. Logs show it had lost track of its own attendance policy for months beforehand.