Prompt injection in CI/CD: securing AI coding agents
Issues, comments and build logs can hijack pipeline agents. Separate untrusted content from secrets, write access, merges and artifact publishing.
- AUTHOR
- Karol Rapacz / Penetration Tester (OSCP, PNPT)
- PUBLISHED
- 13 June 2026
- READING TIME
- 10 min read
- TOPIC
- AI Security
Prompt injection in CI/CD abuses content coding agents must read: issues, pull requests, comments, test names, logs, READMEs and package messages. When the same agent has repository tokens and code execution, text can affect real artefacts.
Separate trust stages
An agent analysing untrusted reports is read-only and secretless. It produces a structured plan or patch on an isolated branch. Another process runs tests, while publishing requires independent approval.
Per-stage tokens
Fork pull requests receive no secrets. Read tokens cannot push, and publishing identities work only for a protected workflow and exact artefact. Prefer short-lived federation to standing keys.
Protect policy
Repository content must not expand command allowlists. Changes to workflows, permissions and security tests need CODEOWNERS and additional review. Check out immutable commit SHAs rather than moving branches.
Tests
Place injections in issues, filenames, test output and dependencies. Attempt environment reads, new-domain connections, weakened tests and automatic merge. Log executor decisions rather than model claims.
OWASP lists repositories and commit messages as indirect-injection vectors. Combine these controls with software supply-chain security and coding-agent hardening.
A pipeline is a series of trust zones
Issues, pull requests, branch names, diffs, test logs and scanner reports are partly author-controlled. An agent may analyse them, but they cannot define their own privileges. Each CI stage receives a separate identity, data set and permission for only the required operation.
Code analysis runs without production secrets and merge rights. Publishing consumes only an artefact approved by previous gates, not arbitrary files from an agent workspace. Workflow or policy changes require a code owner and execution from a trusted branch.
Prevent instruction flow
Wrap untrusted content in explicit structure and reduce it to the required subset. The executor validates every tool call independently of the textual explanation. Allowed commands, paths and domains must be deterministic. A command from a test log can never flow directly to a shell.
Issue short-lived secrets through workload identity, bound to stage, repository and environment. Log masking is a final barrier, not permission to expose all environment variables to a process analysing untrusted code.
Tests and stop conditions
Inject instructions into every text channel, including dependency errors and generated files. Observe real processes, connections, secret reads and configuration changes. A test passes when the executor blocks the action and the log identifies both source and denial rule.
Stop release automatically after attempted cross-tenant access, disabled security tests, self-modified policy or data transfer to a new origin. Run the full regression suite after model or tool updates because resistance is not a property of the prompt alone.
A safe pull-request pattern
Stage one reads the diff and produces structured findings. Stage two runs tests in a secret-free sandbox and stores artefacts. Stage three presents results to a human or deterministic gate. Only a trusted workflow, after approval, may merge or begin publishing.
An agent comment is never an authorisation signal. Use native branch protection, required statuses and CODEOWNERS. An external pull request must not launch a secret-bearing job because its text claims that credentials are necessary.
Evidence and audit
Retain input commit, workflow version, image identifier, workload identity, tool calls and final decision. The log must answer whether the agent only proposed a change or executed an external action.
After an incident, revoke tokens, pause similar workflows and review artefacts from the same source. Move the payload into the red-team harness. Fix the permission boundary rather than adding another forbidden phrase to the prompt.
A quarterly review should remove unused tokens, stale exceptions and broadly scoped workflows. Verify that new integrations have not weakened branch protection. Agent security depends on the whole enforcement chain, not only model configuration.
Sources: OWASP Secure Coding with AI, OWASP Prompt Injection Prevention.
