THE VERDICT
● These are not substitutes. One is a fix-suggestion layer inside your PR flow. The other is an autonomous red team.
● Autofix is the cheaper habit, bundled with GitHub Advanced Security and useful on routine findings at scale.
● Red Agent is the harder truth, because it validates exploitability rather than flagging theoretical risk.
● The lesson from August: do not treat an AI scanner as a gate. Treat it as one signal.
Head to head
|
Copilot Autofix |
Wiz Red Agent |
| Posture |
Defensive |
Offensive |
| What it does |
Explores the codebase, generates a fix, validates it, opens a PR |
Scans, exploits, exfiltrates, assesses blast radius |
| Trigger |
A code scanning alert assigned to it |
Autonomous sweep of an org |
| Human in the loop |
Yes, a human merges the fix |
No, on the Snowflake chain there was none |
| Proves exploitability |
No |
Yes, that is the product |
| Availability |
Bundled with GitHub Advanced Security, since Aug 2024 |
Wiz research tooling, not a self-serve product |
| Covers CI/CD workflow files |
Disputed in this incident |
Yes, that is where it found this |
THE FIVE-DAY WINDOW
The flaw went live on June 18, 2026 when PR #1218 merged. Red Agent found and exploited it on June 23. Five days from ship to validated compromise, with no human involved. Wiz says GitHub Advanced Security analysed the final revision and did not flag it. GitHub says Copilot Autofix never reviewed the code. Only one party holds the logs.
Who should use which
| If you are... |
Do this |
| Already on GitHub Advanced Security |
Keep Autofix on. It is free effort on routine findings |
| Relying on it to gate merges |
Stop. Add manual review for any change touching workflow files |
| Running a bug bounty or VDP |
Assume autonomous agents are already scanning you. Budget triage accordingly |
| Worried about CI/CD specifically |
Neither tool replaces least-privilege tokens and env-var input handling |
FAQ
Is Copilot Autofix bad at security?
This incident does not establish that. What is disputed is whether it ran on the change at all. The commit history also does not support the claim it authored the vulnerable lines.
Can I buy Wiz Red Agent?
It is Wiz research tooling used in authorised testing, not a self-serve product you point at your own org today.
What actually prevents this class of bug?
Passing untrusted input through environment variables rather than expanding it inside run blocks. GitHub documented that in July 2025, a month before the commit that introduced the problem.