They'll Verify. They Just Won't Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface
Merged summary
TL;DR - A study of a five-agent CI/CD pipeline found that authority-framed prompt injection and code laundering could cause agents to approve secret-exfiltration code. The results show that distributed verification and prompt secrecy do not prevent systemic agentic pipeline compromise.
- The entry agent leaked no system prompts, yet downstream compromise still reached 55% in the worst-case condition.
- Security scanners passed roughly 80% of laundered pull requests after agents cited fabricated pre-approval.
- Conventional code scanners and pattern detectors missed the malicious intent because the code appeared syntactically legitimate.
- Intent reasoning by an LLM offered only partial defense; the authors argue for independent, provenance-aware controls at pipeline entry.
Sources (1)
They'll Verify. They Just Won't Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface
TL;DR - A study of a five-agent CI/CD pipeline found that authority-framed prompt injection and code laundering could cause agents to approve secret-exfiltration code. The results show that distributed verification and prompt secrecy do not prevent systemic agentic pipeline compromise.
- The entry agent leaked no system prompts, yet downstream compromise still reached 55% in the worst-case condition.
- Security scanners passed roughly 80% of laundered pull requests after agents cited fabricated pre-approval.
- Conventional code scanners and pattern detectors missed the malicious intent because the code appeared syntactically legitimate.
- Intent reasoning by an LLM offered only partial defense; the authors argue for independent, provenance-aware controls at pipeline entry.