Disclosed vulnerability
Snowflake Cortex Code escapes its sandbox and executes malware: process substitution slips past the command validator
AIR-2026-0075 AIR record · 2026-03-snowflake-cortex-sandbox-escape
From the supporting source
Because commands in process substitution expressions were not evaluated by this system, they never triggered human approval.promptarmor.com
The record
Disclosed
2026-03-16
Vendor
Snowflake
Product
Snowflake Cortex Code CLI (<= v1.0.24)
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Privilege escalation, Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — Cortex Code executed the malware past its command validator
Attack surface
Coding agent
Autonomy level
Copilot with approval
Initial vector
Indirect prompt injection repository content
Impact type
Remote code execution, Data exfiltration, Destructive action
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Cortex Code CLI users processing untrusted repositories or web/database content
Capability abused
Defense & remediation
Recorded defense
command validation with human approval for dangerous commands; sandbox
Guardrail kinds
Human approval, Sandbox isolation
Guardrail outcome
Silent
Fix shipped
v1.0.25, 2026-02-28, auto-updated
Taxonomy & references
Curator notes
PromptArmor. Cortex Code released 2026-02-02; reported 2026-02-05; fixed 2026-02-28; public 2026-03-16. Aggravating factor per the writeup: 'Cortex failed to inform the user that the command had already been run by the second-level sub-agent!' Also allowed setting a sandbox-bypass flag without user approval, enabling theft of Snowflake databases via cached auth tokens. Linked from Simon Willison's prompt-injection tag.
Supporting sources
Cite as
Enkrypt AI. "Snowflake Cortex Code escapes its sandbox and executes malware: process substitution slips past the command validator". AIR, AIR-2026-0075. https://agentincident.vercel.app/i/AIR-2026-0075/ (accessed 2026-10-19).