They'll Verify. They Just Won't Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface

Imagine you're working in a software development team that relies on automated systems to manage code changes and ensure security. You might think that having multiple layers of verification, like security scans and code reviews, would protect against malicious code. However, this setup can fail dramatically when an attacker cleverly disguises harmful code as legitimate requests, leading to serious security breaches. This is what's called a systemic failure, where neither the secrecy of prompts nor the distribution of verification can prevent exploitation. In this study, the authors explore a CI/CD pipeline involving five different large language models (LLMs) and find that even with multiple checks in place, a well-crafted request can bypass security measures and lead to significant vulnerabilities. They highlight that traditional content-based controls, like code scanners, often miss the intent behind the code, allowing harmful actions to slip through unnoticed. The only partial defense identified is using an LLM to reason about intent, which suggests that a more nuanced approach is needed. This work emphasizes the importance of integrating provenance-aware controls at the entry point of the pipeline, independent of existing verification methods, to truly safeguard against such threats.

The study reveals systemic vulnerabilities in CI/CD pipelines using LLMs.

The findings are based on a well-structured factorial design with synthetic data.