Agentic CI/CD Security: Risks, Attack Vectors, and Controls

The report warns that embedding autonomous AI coding agents into CI/CD pipelines significantly expands attack surfaces: agents granted repo write access and runner execution can be prompt-injected via issues, PRs, or external context to modify code or exfiltrate credentials. It outlines five risk classes (excessive agent authority, non-commit attack vectors, credential exposure, runtime supply-chain risks, and external context expansion) and recommends shifting governance—runtime visibility, treating agents as privileged identities, constraining triggers, minimizing secret co-location, and pinning/vendoring agents.