Security firm PromptArmor has disclosed a critical vulnerability in Snowflake's Cortex Code CLI that allowed malicious commands to bypass approval systems and execute outside sandbox restrictions, potentially exposing user credentials and enabling arbitrary code execution.
Vulnerability Discovered Days After Release
PromptArmor identified the security flaw just two days after Snowflake Cortex Code's February 2, 2026 release. The researchers responsibly disclosed the vulnerability on February 5th, and Snowflake deployed a fix in version 1.0.25 on February 28th.
The vulnerability centered on a critical flaw in the command validation system:
- The system was designed to auto-approve "safe" commands while requiring human approval for potentially dangerous ones
- However, the validator failed to inspect commands nested within process substitution expressions like
<() - Attackers could craft malicious injections hidden in repository READMEs or other untrusted data
Sandbox Escape Mechanism
The injection technique manipulated Cortex into setting the dangerously_disable_sandbox flag, which allowed commands to execute outside the sandbox's network and file access restrictions. Combined with the validation bypass, malicious commands ran completely unsandboxed without user consent.
Real-World Impact Demonstrated
Researchers demonstrated that with remote code execution, an attacker could:
- Access Snowflake credentials cached by Cortex
- Execute SQL commands with the victim's privileges
- Steal data or delete tables
- Create unauthorized users or lock out legitimate accounts
Notably, due to context loss in multi-level subagent operations, Cortex sometimes reported warnings about malicious commands while having already executed them silently.
Key Takeaways
- The vulnerability highlights ongoing challenges in securing AI coding assistants that have system access
- Process substitution and other shell features can bypass even well-designed command validation systems
- Users of Cortex Code should ensure they are running version 1.0.25 or later
- The incident underscores the importance of rapid security research on new AI tools