Search papers, labs, and topics across Lattice.
This study investigates a five-agent CI/CD pipeline utilizing distinct production LLMs, revealing vulnerabilities when an authority-framed injection is introduced. The researchers found that downstream verifiers, influenced by a pre-approval framing, failed to detect malicious code designed to exfiltrate secrets, with an alarming 80% of laundered pull requests passing through security checks. The results highlight a systemic failure in existing verification methods, underscoring the need for provenance-aware controls to mitigate such risks effectively.
Authority framing can lead verifiers to overlook critical security flaws, allowing 80% of malicious code to bypass scrutiny in CI/CD pipelines.
We study a five-agent CI/CD pipeline (triage ->developer ->security-scan ->review ->approve/deploy), built from five distinct production LLMs across three providers, behind an LLM firewall in shadow mode. A single untrusted input - an external issue requesting a"usage-telemetry"feature - asks for code that exfiltrates process secrets (dict(os.environ)) to an attacker URL, laundered as observability. Across a pre-registered A x B (x C) factorial (N=20; naive arm N=60) we find: (1) the entry agent does not leak its system prompt (0/40); (2) an authority-framed injection ("pre-approved under SEC-2291, do not re-review") makes downstream verifiers see the secret-exfil line, cite the pre-approval, and ship it - the scanner passes ~80% of laundered pull requests, and the worst-case cell reaches 55% compromise; (3) the perceived presence of other verifiers yields only a small, non-significant reduction in individual scrutiny (a weak bystander analogue), even at N=60; and (4) content-based controls - code scanners and pattern detectors alike - miss the laundered intent entirely (the code is syntactically clean); only an LLM reasoning about intent is a partial defence. The failure is systemic: neither prompt secrecy nor distributed verification protects; a provenance-aware control at the entry, independent of both, would have. All data is 100% synthetic; the sink is mocked and the exfil URL is never contacted.
