{
 "generated": "2026-11-01",
 "node": {
  "id": "event:wiz-snowflake-ai-code-chain",
  "type": "Event",
  "name": "Wiz：AI生成代码引入漏洞，被另一个AI攻破",
  "slug": "wiz-snowflake-ai-code-chain",
  "kind": "incident",
  "kind_zh": "安全事故 / 漏洞披露",
  "date": "2026-06-23",
  "summary": "GitHub Copilot Autofix 生成的一次 AI 协同提交（2026-06-18 上线）删掉原有输入净化逻辑、改为直接字符串展开，引入漏洞；Wiz 的自主 red-team agent 于 06-23 发现并利用，攻破了 Snowflake 的 Jira。官方称 Copilot 是该 PR 的 co-author 且“检查通过”。",
  "evidence": [
   {
    "kind": "own",
    "url": "https://xiaopingfeng.com/landscape/agent-security/#player-wiz-snowflake",
    "text": "Landscape「Agent 安全攻击面」第 06 层「沙盒逃逸 / 越权操作」的卡片「Wiz：AI生成代码引入漏洞，被另一个AI攻破」：Wiz的自主red-team agent于06-23发现并利用该漏洞，攻破了Snowflake的Jira"
   }
  ],
  "entry": "agent",
  "by": "landscape-facts",
  "at": "2026-11-01T11:19:35Z",
  "landscape": [
   {
    "map": "agent-security",
    "map_title": "Agent 安全攻击面",
    "card": "player-wiz-snowflake",
    "title": "Wiz：AI生成代码引入漏洞，被另一个AI攻破",
    "layer": "沙盒逃逸 / 越权操作",
    "layer_id": "layer:agent-security--6",
    "role": "primary"
   }
  ],
  "landscape_maps": [
   "agent-security"
  ],
  "landscape_n": 1,
  "degree": 0
 },
 "page": "https://xiaopingfeng.com/graph/e/event/wiz-snowflake-ai-code-chain/",
 "out": [
  {
   "type": "involves",
   "sentence": "Wiz：AI生成代码引入漏洞，被另一个AI攻破涉及Wiz",
   "direction": "out",
   "id": "org:wiz",
   "name": "Wiz",
   "role": "attacker",
   "note": "Wiz 的自主 red-team agent 发现并利用漏洞",
   "status": "agent",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」第 06 层「沙盒逃逸 / 越权操作」的卡片「Wiz：AI生成代码引入漏洞，被另一个AI攻破」：Wiz的自主red-team agent于06-23发现并利用该漏洞，攻破了Snowflake的Jira",
     "url": "https://xiaopingfeng.com/landscape/agent-security/#player-wiz-snowflake"
    }
   ]
  },
  {
   "type": "involves",
   "sentence": "Wiz：AI生成代码引入漏洞，被另一个AI攻破涉及Snowflake",
   "direction": "out",
   "id": "org:snowflake",
   "name": "Snowflake",
   "role": "victim",
   "note": "Snowflake 的 Jira 被攻破",
   "status": "agent",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」第 06 层「沙盒逃逸 / 越权操作」的卡片「Wiz：AI生成代码引入漏洞，被另一个AI攻破」：Wiz的自主red-team agent于06-23发现并利用该漏洞，攻破了Snowflake的Jira",
     "url": "https://xiaopingfeng.com/landscape/agent-security/#player-wiz-snowflake"
    }
   ]
  },
  {
   "type": "involves",
   "sentence": "Wiz：AI生成代码引入漏洞，被另一个AI攻破涉及GitHub",
   "direction": "out",
   "id": "org:github",
   "name": "GitHub",
   "role": "vendor",
   "note": "GitHub Copilot Autofix 生成了引入漏洞的提交；官方澄清 Copilot 是该 PR 的 co-author",
   "status": "agent",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」第 06 层「沙盒逃逸 / 越权操作」的卡片「Wiz：AI生成代码引入漏洞，被另一个AI攻破」：GitHub Copilot的Autofix功能生成的一次AI协同提交",
     "url": "https://xiaopingfeng.com/landscape/agent-security/#player-wiz-snowflake"
    }
   ]
  },
  {
   "type": "placed_in",
   "sentence": "Wiz：AI生成代码引入漏洞，被另一个AI攻破出现在 Landscape 的「沙盒逃逸 / 越权操作」",
   "direction": "out",
   "id": "layer:agent-security--6",
   "name": "沙盒逃逸 / 越权操作",
   "reported": false,
   "status": "derived",
   "evidence": [
    {
     "kind": "own",
     "label": "本站页面",
     "text": "Landscape「Agent 安全攻击面」第 06 层「沙盒逃逸 / 越权操作」：卡片「Wiz：AI生成代码引入漏洞，被另一个AI攻破」",
     "url": "https://xiaopingfeng.com/landscape/agent-security/#player-wiz-snowflake"
    }
   ]
  }
 ],
 "in": []
}