AI Agents: when the autofix becomes a back door

The bot found a problem in the code, suggested a fix, someone clicked "accept" and the fix opened a hole bigger than the original problem. This is not hypothetical. It happened to Snowflake, a data company worth billions with a real security team. Wiz researchers showed that an automatic AI-generated fix, accepted inside the company's automation flow, became the path into the internal Jira. This is the blind spot of AI agents that almost nobody is watching: we audit what AI writes from scratch, but we blindly trust what it "fixes".

If you own a business and think this is developer talk, hold on a second. Jira is where a company keeps what is broken, what is shipping, who complained about what. It is the operation's logbook. An outsider reading that knows more about your business than half your team.

What exactly happened

Here is the plain version. GitHub has a feature called autofix that uses AI to read a security alert and propose the patch. Excellent idea on paper: the machine finds it, the machine fixes it, you approve. The problem is what happens after the "approve".

In this case, the AI-generated fix was folded into the automatic flow that runs every time someone touches the code. That flow had broad permissions and access to credentials that opened doors into other systems. A researcher managed to manipulate the process and, at the end of the line, reach the company's Jira.

Notice the sequence, because it is the heart of the story:

• The AI generated code.
• The code went through a review that was, in practice, a rubber stamp.
• That code ran inside an environment with powerful keys.
• Nobody asked "if this fix is wrong, what can it reach?".

Each step alone looks reasonable. Together, they become a problem. And Snowflake got the hard part right: they received the report, fixed it fast, published it. Most companies would never even find out.

Why "fixing" is more dangerous than "creating"

When you ask AI to write a new feature, your brain turns on skeptic mode. You read, test, question. When it fixes a bug that it flagged itself, something curious happens: the alert arrives wearing the look of authority. "Vulnerability found. Fix suggested." It feels like antivirus. You accept.

Except the model does not understand your business. It understands code patterns. It saw ten thousand similar fixes and produced the ten thousand and first. It has no idea whether that specific file runs with admin permission or whether that token opens the customer database.

AI does not fail out of stupidity. It fails because it does not know where it is stepping.

In 2025 and 2026 this got worse for a simple reason: volume exploded. A team that reviewed twenty changes a week now gets two hundred. Average quality even went up. Human attention per change collapsed. That is the math nobody did.

What this has to do with your company

You probably do not have CI/CD with ten thousand runs a day. But if you use AI agents anywhere in your business, the pattern is identical. Some cases I see in practice:

An agent that replies to customers. You connected the bot to the order system so it can check status. Great. It checks with which permission? If it can read any customer's order, a clever customer figures that out in twenty minutes of conversation.

Automation that touches a spreadsheet or ERP. The agent has write access "to make things easier". One day it misreads a request and deletes a column. There is no malice, it is just a mistake. But the damage is real.

Email integration. The agent reads the inbox to triage messages. Anyone in the world can email you. Which means anyone in the world can put text inside your agent. If it has permission to reply and send attachments, you just handed a megaphone to a stranger.

The common denominator is not the AI. It is the permission. AI only sped up how fast a badly configured permission turns into a problem.

Three questions before turning on any agent

This is not a corporate security checklist. It is the minimum I do on any automation I deliver, and it takes fifteen minutes.

1. If this agent goes haywire, what is the worst possible damage? Write the answer down. Literally. If the answer is "it sends a wrong email", relax. If it is "it wipes the customer database" or "it transfers money", you need a brake before moving on.

2. Does it really need to write, or only read? Ninety percent of the agents I see in small and mid-sized companies only need read access. Look up, summarize, notify. A person does the writing, after taking a look. Swapping write for read removes most of the risk without taking away almost any of the value.

3. When it fails, will you find out? It is not "if". It is "when". If the agent gets it wrong and nobody gets an alert, you will find out from the customer complaining. Or worse, you will not find out.

The human approver needs to be an actual human

Here is my unpopular opinion: automated review with a human rubber stamp is worse than having no review at all. Because it produces the feeling of safety without the safety.

If your process is "AI suggests, So-and-so approves" and So-and-so approves forty things a day at three minutes each, you do not have approval. You have theater. And theater is expensive: the moment it goes bad, everyone points at So-and-so, who never really had a chance to review anything.

The right way is to separate what needs human eyes from what does not. Fixing text in a footer? Automatic, carry on. Anything that touches credentials, permissions, payments or customer data? It stops in the queue and waits for a person with time to think. Fewer things in the queue means more attention on each one.

In practice, this usually becomes a simple two or three line rule in your automation. It is not a six month project.

The consolation: the one who got caught is the one who was looking

There is a detail in the Snowflake story that I find the most important of all, and almost nobody mentions it. This hole only surfaced because there was a program for outside researchers to report flaws. Someone went in, looked, found it, reported it. The company fixed it and let it be published.

Which means: the companies that show up in this kind of news are usually the ones doing more than average, not less. The ones that never show up are not safer. They are just less observed.

That should reassure you and bother you at the same time. Reassure, because getting this wrong is normal, nobody has it solved. Bother, because if Snowflake, with all its apparatus, let one slip, your automation built in a rush over three afternoons probably has something worse. And nobody is looking.

I am not telling you to shut down your agents. I build AI automation every day and I would not go back. The gain is far too big. I am telling you to stop treating "the AI suggested it" as a guarantee of quality. It is a suggestion. A very good suggestion, made by something that does not know where it is stepping.

If you already have agents running in your business and never asked the three questions above, half an hour of conversation is worth it to map what is exposed. It is usually simpler to fix than it looks, and a lot cheaper now than later. Tell me what you automated and let's look at it together.

Snowflake took a security hit because of an AI-suggested fix that someone approved without really looking.

The detail that got me: we distrust what AI writes from scratch, but we accept almost blindly what it "fixes". A vulnerability alert looks like authority, and authority switches off critical thinking.

The problem was never the AI. It was the permission it was given.

Three questions I ask before turning on any agent: if it goes haywire, what is the worst damage? Does it actually need to write, or only read? And when it fails, does anyone find out?

Automated review with a human rubber stamp is worse than no review at all, because it produces the feeling of safety without the safety.

If you already have agents running in your business and never asked these questions, tell me what you automated. Let's look at it together.

#AI #AIAgents #Automation #InformationSecurity #Technology