Snowflake Cortex Code CLI version 1.0.25 patched a critical vulnerability allowing attackers to bypass security sandboxes and execute malicious commands on Snowflake cloud databases. The flaw, disclosed Feb 5, 2026, stemmed from unvalidated process substitution expressions in the CLI tool, enabling remote code execution without user approval. Attackers could chain this with prompt injection techniques to download and run scripts leveraging cached Snowflake credentials, potentially exfiltrating data or destroying tables.

The attack exploited Cortex’s failure to validate commands nested in shell process substitutions (<()>), which evaded human-in-the-loop approval. By manipulating the model to set an unsandboxed execution flag, attackers triggered commands outside Cortex’s security perimeter. This allowed direct access to Snowflake instances using victim credentials, bypassing network restrictions. Impacts included data theft, table deletion, and unauthorized user creation – particularly severe for developers with administrative access.

Snowflake’s advisory details how the vulnerability emerged from overlooked command parsing logic, with attackers exploiting third-party code repositories as entry points. The fix, deployed March 1, 2026, now blocks unsafe command combinations and enhances sandbox isolation. The incident highlights risks in AI coding assistants handling privileged database access, emphasizing the need for rigorous validation of LLM-generated commands.

Snowflake’s Community Site provides technical specifics at https://community.snowflake.com/s/article/PromptArmor-Report---Snowflake-Response. The incident underscores evolving threats in AI-powered developer tools, where prompt injection and sandbox evasion could compromise enterprise infrastructure. Organizations using Cortex Code must enforce strict access controls and monitor for anomalous command patterns.