AI agents in your code: when the fix opens the door

You approved a fix because the system said it solved a security problem. Weeks later, you find out that this very fix is what left the door open. That's roughly what happened at Snowflake. And it's a great picture of how AI agents are changing the way companies work, for better and for worse.

You don't need to be a developer to follow this. I promise.

What happened in the Snowflake case

Snowflake is a giant data company. It has a security team, processes, audits. It's not your nephew building a website over the weekend.

It uses GitHub to store its code. And GitHub has a tool called Copilot Autofix. The AI finds a problem in the code and suggests a ready-made fix. Someone on the team takes a look, clicks approve, and that's it.

Researchers at Wiz, a security company, ran their own bug-hunting agent. It found something curious. One of these AI-generated fixes, applied to the part that automates code testing and publishing, created a new gap. Through it, an outsider could make the company's system run commands and reach internal credentials. With those, they could get into Snowflake's Jira, the tool where the team organizes tasks, bugs and projects.

The flaw was reported and fixed. Nobody walked off with the vault. But the message stuck.

Notice the irony. The AI was called in to patch a hole. It patched one and opened another, in a more sensitive spot. And a human approved it, because it looked right.

Why this matters even if you don't have an IT team

You might be thinking: "Diego, I run a clinic. A store. A 15-person company. I don't use GitHub."

Fair enough. But swap the names and the story is the same:

• The AI agent that answers customers on WhatsApp and has access to your order system.
• The automation that reads emails and records invoices in your finance system.
• The assistant that "organizes" your customer spreadsheet and has permission to delete rows.

In all of these cases, you have an AI that acts, not just talks. And every AI that acts holds a key. The question is: which doors does that key open?

In the Snowflake case, the key opened more doors than it should have. And nobody noticed until an outsider tested it.

AI agents make mistakes differently from people

A new employee who doesn't know how to do something usually hesitates. They ask. They take their time. They look unsure.

AI doesn't look unsure. It delivers a clean, well-formatted answer in a confident tone. Even when it's wrong.

That changes the psychology of whoever is reviewing. When the fix comes from a tool with a big company's stamp on it, labeled "security fix", the instinct is to trust it. You skim it, see that it makes sense and approve. I've done it. You probably have too, with a contract, a quote or a report.

AI doesn't make mistakes that look like mistakes. It makes mistakes that look like solutions.

That's the dangerous part. It's not that AI is dumb. It's that it's convincing, and we relax when something sounds convincing.

The problem isn't the AI, it's the permissions

Here's my strong opinion: most disasters with AI agents won't be the AI's fault. They'll be the fault of whoever gave it too much access.

Think of it this way. If you hire an intern to sort out your inventory, you don't hand over your bank password too. Not because they're dishonest. Because they don't need it to sort out the inventory.

With AI, we do the opposite all the time. We connect the agent to the main Google account. We give it admin access to the system because "it's easier to set up". We use the same password for everything because the integration asked for one and that one was handy.

In the Snowflake case, that was the core problem. An automated process was running with more power than it needed, in a place where a stranger could influence what it did. The AI just paved the way.

How to use AI agents without exposing your company

I'm not telling you to run away from AI. I build agents for clients every week. They save real hours. A clinic I worked with stopped losing after-hours bookings. An office cut its email triage time in half.

But there are rules I always follow. They're simple, and they work for companies of any size.

1. Minimum access. The agent only sees what it needs to do the job. The support bot checks available times. It doesn't need to see your revenue.

2. Separate reading from acting. Letting AI read is one thing. Letting it delete, pay, send or publish is another. Actions that can't be undone go through a human.

3. Approving is work, not a click. If someone on your team approves what the AI suggests, they need to know what they're approving. If they don't understand it, the approval is theater. Better to not have the button at all.

4. Separate credentials for each automation. Never use your personal password in an integration. Each agent gets its own key, one you can revoke in a minute if something goes wrong.

5. Log everything. Every action the agent takes gets recorded: what it did, when, and based on what. When something goes wrong, and eventually it will, you find out in minutes, not weeks.

None of these rules require expensive tools. They require someone to think about this before switching the agent on, not after the scare.

What if I already have agents running?

Do a quick test. Take every automation or assistant you use today and answer three questions:

1. Which accounts and systems does it access?
2. What can it do on its own, without anyone approving?
3. If tomorrow it did the worst possible thing with that access, how much damage would it do?

If the answer to the third question made your stomach drop, you've found the spot to fix. Most of the time, the fix is removing permissions that were never used. It takes an afternoon.

One important detail: the Snowflake flaw itself was discovered by an AI agent, just on the defense side. In other words, the same technology that created the hole helped find it. The game isn't "AI or no AI". It's who's using it, how carefully, and with whom watching.

The lesson I take from this

If a company the size of Snowflake, with a dedicated security team, let a gap created by an automatic fix slip through, your company can too. That's no reason to panic. It's a reason to treat an AI agent the way you treat a new employee with system access: with trust, but with clear limits.

AI will keep getting more capable. Agents will do more and more on their own. The winners will be the ones who set up the house properly from the start, not the ones who connected everything to everything just to see what happened. Spoiler: it usually ends in a panicked phone call on a Friday at 6 p.m.

If you want to put AI agents to work in your business, with your feet on the ground and the doors locked, I can help you design it. Get to know my work and let's talk.

AI doesn't make mistakes that look like mistakes. It makes mistakes that look like solutions.

At Snowflake, an AI-generated security fix was approved by someone on the team. It ended up opening a new gap, one that led to internal credentials.

The problem wasn't the AI. It was giving it too much access and approving without understanding what was being approved.

If you have an agent on WhatsApp, in your finance system or in your customer spreadsheet, ask yourself: if tomorrow it did the worst possible thing with that access, how much damage would it do?

Minimum access, a human on every action you can't undo, and a log of everything. It isn't expensive. It just means thinking before the scare.

I wrote about this on the blog. If you want to put agents to work with the doors locked, let's talk.

#ArtificialIntelligence #AIAgents #CyberSecurity #Automation #Business