Can an AI agent really hack a company on its own in 2026?

Wiz Red Agent vs Snowflake: The Real Lesson for Founders

Yes. On August 17, 2026, Wiz published research showing its autonomous Red Agent finding, exploiting, and self-correcting an attack on a Snowflake GitHub workflow, pulling internal Jira credentials with no human touching a keyboard. The AI-wrote-the-bug half of the story collapsed under scrutiny, and Daugherty and Wilson’s Radically Human names the surviving lesson: trust and provenance are now the operator’s job.

I watched this story assemble itself and then partially fall apart inside a single news cycle this week, and both halves are field notes for anyone who delegates real work to AI. On August 17, 2026, Wiz published research claiming two things at once: that an AI had written a critical flaw into Snowflake’s code, and that another AI — Wiz’s own autonomous Red Agent — had found and exploited it. The second claim held up completely. The first collapsed in about eight hours.

Start with what actually happened, because it deserves your attention. Red Agent, scanning Snowflake’s GitHub organization under the company’s HackerOne disclosure program, flagged a workflow file in the public snowflake-connector-net repository. The jira_issue.yml workflow ran whenever anyone on the internet opened an issue, and it dropped the issue title straight into a shell script. A guard condition looked protective but compared a pull-request property that does not exist on issue events — GitHub evaluates a missing property as an empty string, so the gate waved every visitor through.

The detail that made me put my coffee down: the agent’s first payload failed with a shell syntax error. It read the error, worked out that its comment character had swallowed a closing bracket, rewrote the payload, and got a working callback within seconds. Nobody touched a keyboard. The token it extracted granted read access to Snowflake’s engineering, security compliance, and bug bounty Jira projects. The whole exposure window was five days: Wiz disclosed on June 23, 2026, and Snowflake patched the same day and rotated the credential on June 24.

Now the half that fell apart. Wiz’s post initially framed GitHub Copilot Autofix as a co-author of the vulnerable commit — an AI writing the bug that an AI later exploited, which is the version that travelled. Then The Hacker News read the actual commit history: Copilot’s co-authored commit changed a different file, and the unsafe refactor sits in a separate 2025 commit attributed to a named Snowflake engineer. The co-author line was a squash-merge artefact — it records participation in the pull request, not authorship of the broken lines. GitHub disputed the framing, Wiz softened its post the same evening to “it’s unclear whether the code-change was AI-assisted,” and The Register appended a correction to its coverage.

Paul Daugherty and H. James Wilson argue in Radically Human that trust is not a compliance checkbox but a competitive advantage, and that the companies that win with AI are the ones that keep humans accountable for what the machines do. This incident is that argument running live. In a squash-merge world, “who wrote this line — a human or an AI” is now unanswerable by default, which means blame becomes contested marketing between a Google-owned security firm and a Microsoft-owned platform. If provenance is ambiguous at Snowflake’s scale, it is ambiguous in your ten-person repo too.

The Provenance Audit — four steps before you trust AI-touched code

Treat AI co-author tags as participation, not authorship. Before you assign credit or blame to a tool, read the commits underneath the squash — that is exactly the check that unravelled this story.
Assume attacker speed is now machine speed. The entire window here was five days; your patch cadence and secret rotation need to be measured on that clock, not on quarterly review.
Move untrusted-input handling — issue titles, form fields, webhook payloads — to the top of your review checklist, because that is where autonomous agents look first.
When a vendor headline says “AI did it,” wait one news cycle before you repeat it. This one reversed in eight hours.

The honest limits of the finding: this was authorized testing inside a disclosure program, against one flaw at one company, by a firm with an obvious commercial interest in autonomous security agents looking scary. Red Agent did not display general intelligence; it displayed persistence and error-recovery on a well-known vulnerability class. And the same agent capability is available to defenders — which is precisely why I have added a scheduled agent scan of my own public repos rather than a panic.

What survives the correction is still the most important AI-and-work data point of the week. An autonomous system scanned, exploited, failed, diagnosed its own failure, and succeeded — unsupervised. My working conclusion as a builder and a coach is the same one Radically Human keeps circling: the more capable the machine, the more valuable the human who stays accountable for it. Delegation without provenance is not leverage. It is exposure with better ergonomics.

Sources: Wiz Research disclosure, The Next Web on the GitHub dispute, The Hacker News commit-history analysis, SC Media.