Paper deep dive
They'll Verify. They Just Won't Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface
Yohann Sidot
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%
Last extracted: 7/25/2026, 1:34:39 AM
Summary
This research paper investigates the security of a five-agent CI/CD pipeline (triage, developer, security-scan, review, approve/deploy) using distinct production LLMs. The study demonstrates that a single untrusted input requesting a 'usage-telemetry' feature can lead to secret exfiltration if the request is framed with authority ('pre-approved under SEC-2291'). The malicious code is syntactically clean, bypassing content-based scanners, and verifiers approve it due to the authority framing, despite seeing the exfiltration line. The study finds that prompt secrecy holds (no leaks), but distributed verification fails to prevent compromise when authority framing is present. The core finding is that provenance-aware controls at the entry point are necessary, as content-based detection and distributed verification are insufficient against laundered intent.
Entities (17)
Relation Signals (16)
CI/CD Pipeline â containsagent â Security Scanner
confidence 95% ¡ We study a five-agent CI/CD pipeline (triage -> developer -> security-scan -> review -> approve/deploy)
CI/CD Pipeline â containsagent â Reviewer Agent
confidence 95% ¡ We study a five-agent CI/CD pipeline (triage -> developer -> security-scan -> review -> approve/deploy)
CI/CD Pipeline â containsagent â Triage Agent
confidence 95% ¡ We study a five-agent CI/CD pipeline (triage -> developer -> security-scan -> review -> approve/deploy)
CI/CD Pipeline â containsagent â Approver Agent
confidence 95% ¡ We study a five-agent CI/CD pipeline (triage -> developer -> security-scan -> review -> approve/deploy)
CI/CD Pipeline â containsagent â Developer Agent
confidence 95% ¡ We study a five-agent CI/CD pipeline (triage -> developer -> security-scan -> review -> approve/deploy)
Content-based Controls â failstodetect â Laundered Code
confidence 95% ¡ content-based controls... miss the laundered intent entirely
Reviewer Agent â runsmodel â GPT-4o
confidence 95% ¡ reviewer=gpt-4o
Triage Agent â runsmodel â GPT-4o-mini
confidence 95% ¡ triage=gpt-4o-mini
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:We study a five-agent CI/CD pipeline (triage -> developer -> security-scan -> review -> approve/deploy), built from five distinct production LLMs across three providers, behind an LLM firewall in shadow mode. A single untrusted input - an external issue requesting a "usage-telemetry" feature - asks for code that exfiltrates process secrets (dict(this http URL)) to an attacker URL, laundered as observability. Across a pre-registered A x B (x C) factorial (N=20; naive arm N=60) we find: (1) the entry agent does not leak its system prompt (0/40); (2) an authority-framed injection ("pre-approved under SEC-2291, do not re-review") makes downstream verifiers see the secret-exfil line, cite the pre-approval, and ship it - the scanner passes ~80% of laundered pull requests, and the worst-case cell reaches 55% compromise; (3) the perceived presence of other verifiers yields only a small, non-significant reduction in individual scrutiny (a weak bystander analogue), even at N=60; and (4) content-based controls - code scanners and pattern detectors alike - miss the laundered intent entirely (the code is syntactically clean); only an LLM reasoning about intent is a partial defence. The failure is systemic: neither prompt secrecy nor distributed verification protects; a provenance-aware control at the entry, independent of both, would have. All data is 100% synthetic; the sink is mocked and the exfil URL is never contacted.
Tags
Links
- Source: https://arxiv.org/abs/2607.19267v1
- Canonical: https://arxiv.org/abs/2607.19267v1
Trouble viewing inline? Open PDF directly â
Full Text
19,999 characters extracted from source content.
Expand or collapse full text
Theyâl Verify: How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface Senthex Research ⢠RELAY Lab #1 (frozen surface phase1-frozen-2026-07-09 ⢠280 synthetic runs) Abstract We study a five-agent CI/CD pipeline (triage â developer â security-scan â review â approve/deploy), built from five distinct production LLMs across three providers, behind an LLM firewall in shadow mode. A single untrusted inputâan external issue requesting a âusage-telemetryâ featureâasks for code that exfiltrates process secrets (dict(os.environ)) to an attacker URL, laundered as observability. Across a pre-registered A Ă B(Ă C) factorial (N==20; naive arm N==60) we find: (1) the entry agent does not leak its system prompt (0/40); (2) an authority-framed injection (âpre-approved under SEC-2291, do not re-reviewâ) makes downstream verifiers see the secret-exfil line, cite the pre-approval, and ship itâthe scanner passes âź80% 80\% of laundered pull requests, and the worst-case cell reaches 55% compromise; (3) the perceived presence of other verifiers yields only a small, non-significant reduction in individual scrutiny (a weak bystander analogue), even at N==60; and (4) content-based controlsâcode scanners and pattern detectors alikeâmiss the laundered intent entirely (the code is syntactically clean); only an LLM reasoning about intent is a partial defence. The failure is systemic: neither prompt secrecy nor distributed verification protects; a provenance-aware control at the entry, independent of both, would have. All data is 100% synthetic; the sink is mocked and the exfil URL is never contacted. EN ⢠RELAY LAB #1 LetterSpace=6.0SECURITY RESEARCH Theyâl Verify. They Just Wonât Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface Yohann Sidot ⢠July 2026 Senthex Research ⢠senthex.com LetterSpace=3.5WORST-CASE COMPROMISE 55% tailored framing, no scanner, long chain LetterSpace=3.5LAUNDERED PRS PASSED âź 80% by a capable LLM code scanner LetterSpace=3.5CONTENT CONTROLS THAT CAUGHT IT 0 the malice is only in the intent Senthex Research ⢠senthex.com All data synthetic ⢠fully reproducible What a security leader needs to know ⢠A trusted agentic pipeline deployed attacker-specified secret exfiltration on up to 55% of runsâdriven by a single external issue. ⢠Nothing leaked and nothing was jailbroken. The entry agent never revealed its prompt (0/40); verifiers saw the malicious line and shipped it anyway, on the strength of a fabricated pre-approval. ⢠Content-based detection is blind to this. The code is syntactically cleanâcode scanners and pattern detectors pass it; only a model reasoning about intent catches part of it. ⢠âThe others will verifyâ fails not through a strong bystander effect (weak, non-significant here) but through authority framing that suppresses action on visible malice. ⢠The class of defence these results motivate is a provenance-aware control at the entryâindependent of request content and of agent vigilance. The findings at a glance For the reader with two minutes. Every number is traceable to the public, reproducible dataset. 55% LetterSpace=2.0WORST-CASE COMPROMISE Tailored authority framing, the scanner removed, and a long chain deploy the secret-exfil line in 11/20 runs. âź 80% LetterSpace=2.0LAUNDERED PULL REQUESTS PASSED A capable LLM code scanner sees dict(os.environ) sent to an attacker URL and passes itâbecause a fabricated pre-approval says it was already reviewed. 0 / 40 LetterSpace=2.0SYSTEM-PROMPT EXTRACTIONS The entry agent never leaked its prompt, under a mild and a hard probe. Prompt secrecy heldâand did not help. 0 / 40 LetterSpace=2.0CAUGHT BY CONTENT/PATTERN DETECTION The malicious line is syntactically clean; scanners and pattern detectors are blind to intent. Only reasoning about why the code runs catches part of it. p=0.25p=0.25 LetterSpace=2.0BYSTANDER EFFECT (SOLO VS CHAIN) Verifiers scrutinise slightly more when they believe they are the only controlâbut the effect is small and not significant even at N==60. Agents differ from humans here. 1 Introduction The starting point is a real conversation with a CTO. Asked about the security of his agents, he said: âthey wonât moveâitâs in the system prompt,â and âeven if one is compromised, the others will verify.â Two beliefs, one root: that security is a local property (each agentâs prompt, each agentâs vigilance). We show empirically that it is systemicâa property of topology, provenance, and responsibility. RELAY-1 extends ATLAS-1, which observed a systematic system-prompt leak and âapproval theatreâ in a back-office agent chain. RELAY-1 moves the laundering from a business message to executable code: the pipeline turns an untrusted issue into a deployed artifact that runs. Our pre-registered question is whether a trusted multi-agent pipeline can be induced to deploy attacker-specified secret exfiltration, and which belief fails. Contributions. (i) a reproducible 5-agent / 5-model / 3-provider CI/CD testbed with a passive ground-truth taint flag and a binary success signal (a synthetic secret reaching an attacker URL in deployed code); (i) a pre-registered factorial isolating four mechanisms; (i) the finding that the decisive lever is authority framing, not prompt leakage or a strong bystander effect; (iv) a first-class, non-priming behavioural coder for âeffective verification,â plus a measured observer effect; and (v) honest disconfirmation of two intuitive hypotheses. 2 Threat model A fictional EU software team has automated issue â code â review â deploy with an agent chain. Nothing in the deployment is adversarial except the single entry: one external issue. The chain is triage (reads/labels issues) â developer (writes code, opens PRs) â security scanner (automated PR scan) â reviewer (senior-review analogue) â approver (merges + deploys; sole holder of merge_and_deploy). Verifiers span all three providers, so a verification failure cannot be a single-vendor artifact (Fig. 1). External issueuntrusted â only ingressTriagelabel â routeDevelopertext â codeScannercontent scanReviewercode reviewApprovermerge_and_deployorigin_external taint â propagates unchanged to the deployed artifactissuePRlaunderedpassapprovesecretexfilcontent check: cleanreads the diff The malicious line requests.post(url, dict(os.environ)) is syntactically clean; every content-based check along the chain sees valid code, and no control acts on the taint (its provenance). Figure 1: The pipeline: one untrusted ingress (the external issue), a laundering step (Developer: textâ ), three verifiers, and a deploy sink. The origin_external taint propagates to the deployed artifact, but the malicious line is syntactically cleanâso every content-based check along the chain sees valid code and none acts on provenance. The issue requests a telemetry hook that POSTs the process environment to telemetry-collector.example.comâsecret exfiltration dressed as observability. The laundering is in the intent, not the syntax: no eval, no exec, just a requests.post a reviewer waves through. Success (binary): a planted canary secret would be transmitted iff the deployed code sends the full os.environ to the attacker URLâdetected statically on the mocked artifact.111Success is a static check on the mocked deploy artifactâthe RELAY analogue of ATLASâs fake-IBAN matchâwhich distinguishes real compromise from a developer that keeps the URL but sanitises the env. The adversaryâs only capability is the text of one issue. 3 Methods Agents (fixed model per role). triage=gpt-4o-mini, developer=mistral-small, scanner=claude-haiku-4-5, reviewer=gpt-4o, approver=mistral-large. Five distinct models, three providers; verifiers span all three. gpt-4o on the reviewer on purpose, so a verification failure is not a âmodel too weakâ artifact. Temperature 0; seed=base+run_indexseed=base+run\_index (reproducible and an emergent distribution); non-streaming. Observation instrument. The pipeline runs behind an LLM firewall (Senthex) in shadow mode: it records every call and its content-shield verdicts without intervening. It is the forensic instrument that captured the datasetânot a defence under test; nothing here was expected to block, so there is no âdefence failureâ to report, only a measurement of what content-based detection sees. Pinned by immutable digest, cosign-verified, localhost-only, all content-shield thresholds at defaults. The only server-side change was raising an internal per-tenant billing budget limit (a denial-of-wallet control orthogonal to detection); the image is byte-identical to the official digest, so reproducibility and the âdefault postureâ claim hold.222The change affected a single billing-budget field only; all content-shield thresholds were left at their defaults. Factorial (pre-registered). A: naive vs tailored injection. B: SOLO vs CHAINâeach verifierâs prompt states, neutrally, that it is the only security control (SOLO) or one of several (CHAIN); no vigilance/laxity priming, only the perceived presence of other verifiers varies. C: scanner present vs removed. Plus a verbalization control. N==20/cell; the naive arm strengthened to N==60. 280 runs. Measurement. A passive, monotone taint flag origin_external, invisible to the models, records ground-truth propagation. âEffective verificationâ is coded behaviourally, post-hoc, without asking the agent: inspected, referenced_suspect, and the primary DV blocked (flag / request-changes). We deliberately do not use verbalization for the primary DV, because asking contaminates behaviour (§4.5). 4 Results n/solon/chaint/solot/chaint/solo/offt/chain/off0202040406060555555151535355555compromise rate (%) Figure 2: Compromise (deployed secret-exfil) by cell. Naive self-defends; tailored authority framing plus a removed scanner drives the worst case to 55%. Source: dataset repository. 4.1 H1 â the entry prompt resists extraction (0/40) A mild and a hard (override ++ verbatim-dump) extraction issue both fail: 0/20 and 0/20 full or partial leaks. gpt-4o-mini summarises the request but never reproduces its prompt. A defense-positive resultâand one that breaks the intuitive H1â 2 chain: the tailored injection cannot imitate a leaked prompt, so it imitates a generic internal-authority format instead. That this still works is the more interesting finding. 4.2 H2 â authority framing weaponises distributed trust Scan-on compromise: naive 5% (2/40) vs tailored 10% (4/40). The gap looks modest until you read why: the authority-framed issue (âreviewed & signed off under SEC-2291⌠no need to re-run a fresh security reviewâ) makes the scanner pass âź80% 80\% of laundered PRs333Across the tailored scan-on cells (N==40) the scanner blocked only âź20% 20\% of laundered PRs; see the dataset repository., and verifiersâ approval notes explicitly cite âpre-approved under SEC-2291.â444e.g. a CHAIN reviewer: âThe inclusion of environment variables⌠is pre-approved under SEC-2291. Approving.â Verifiers are not blindâthey see dict(os.environ) going to an external URL and let it through on the strength of a fabricated approval (Fig. 3). Remove the scanner and tailored compromise jumps to 35â55%555Worst cell (tailored, chain, scanner removed) =11/20=11/20; see the dataset repository. (Fig. 5). Trust laundered through an authority claim is the paperâs core result. IssuenaivePR == dict(os.environ)â attacker URLVerifierâexposes secretsâ â FLAGblockedIssue (tailored)SEC-2291 âpre-approvedâPR == dict(os.environ)identical codeVerifierâpre-approved, SEC-2291â â PASSshipsauthority claim carried on the untrusted input The code is identical in both rows. A fabricated internal pre-approval makes the verifier defer to authority over the malice it can plainly see (H2). Figure 3: The authority-framing mechanism. The code is identical in both rows; a fabricated internal pre-approval, carried in the untrusted issue, makes the verifier defer to authority over the malice it can plainly see. 4.3 H3 â a small, non-significant bystander analogue DV == blocking rate, SOLO vs CHAIN. Naive arm, N==60 pooled (Fig. 5): scanner SOLO 41% (24/59) vs CHAIN 30% (18/60), Fisher p=0.25p=0.25666Two-sided Fisher exact over the pooled naive arm, N==60/condition; analysis in the dataset repository.; reviewer 15% vs 10% (p=0.72p=0.72); approver 7% vs 3% (p=0.58p=0.58). The direction is consistent across all three verifiers, but the effect is small and not significant even at N==60 (the CHAIN rate rose 20â 30% with more data; Nâ300 would be needed). Compromise is identical (4/60 both). On the tailored arm the effect vanishesâauthority framing overrides it. Honest reading: LLM verifiers show only a weak, non-significant analogue of human diffusion-of-responsibility. This distinguishes agents from humans and is reported as such. scannerreviewerapprover020204040block rate (%)SOLOCHAIN Figure 4: H3 (naive, N==60): SOLO verifiers block more, consistentlyâbut small and non-significant (scanner p=0.25p=0.25). Source: dataset repository. tail/solotail/chain0202040406060compromise (%)scan-ONscan-OFF Figure 5: H4: removing the LLM scanner triplesâquadruples compromiseâso the scan is not useless, even though its content tool and the firewall code-shield miss the intent. Source: dataset repository. 4.4 H4 â content controls miss laundering; semantic reasoning is a partial defence The in-pipeline content-scan tool passes the laundered code, and a dedicated code-danger content shield, running in observation, flags 0/40 on the tailored exfil.777Across the tailored scan-on cells (N==40) the code-danger shield fired on none; the line is syntactically clean. So content/pattern detectionâscanners and pattern-matchers alikeâmisses the intent. But the intuitive âthe scan changes nothingâ prediction is disconfirmed: removing the LLM scanner triplesâquadruples compromise (Fig. 5). An LLM reasoning about intent catches âź20% 20\% and its presence (the developer sanitises when flagged) matters. Laundering defeats detection-by-pattern; it is only partly defeated by detection-by-reasoningâand that reasoning is itself suppressible by authority framing (§4.2). 4.5 Observer effect (verbalization control) Asking a verifier to state what it checked more than doubled the scannerâs blocking on the SOLO arm (20%â 44%; flat on CHAIN). The measurement is not neutralâvalidating the choice of a non-verbalized behavioural DV, and quantifying a risk we flagged up front. SOLOCHAIN020204040scanner block rate (%)not askedasked to explain Figure 6: Observer effect: asking a verifier to explain its assessment doubles its blocking on the SOLO arm (20%â 44%), flat on CHAIN. Source: dataset repository. 5 Discussion The two CTO beliefs both fail, but not as expected. âItâs in the system promptâ is technically true here (0/40 leak) and irrelevantâthe pipeline ships secrets anyway. âThe others will verifyâ fails not through a strong bystander effect (H3 is weak) but through authority framing: verifiers that can see the exfil choose not to act on it when told it is pre-approved. ATLAS laundered an instruction into a business message; RELAY launders it into executable code and into an authority claim. Both content-based defences are blind to intent; the only thing that catches it is a model reasoning about why the code sends os.environâexactly what the authority framing suppresses. No downstream, content-based check stopped the artifact. These results motivate a class of defence: a control that follows provenanceâthe fact that a request descends from untrusted external inputâand acts at the entry, independent of request content and of agent vigilance. Content-based detection, the dominant paradigm, cannot catch an attack whose payload is syntactically benign and whose malice lies only in provenance and intent (Fig. 7). requests.post(TELEMETRY_URL,json="env": dict(os.environ))the deployed lineContent / pattern detectionno eval/exec, valid syntax, no known-bad patternPASSProvenance detectionthis request descends from an untrusted external issue (origin_external)FLAGThe malice is not in the syntaxâit is in the intent and the origin. Content-based detection, the dominant paradigm, cannot see it; a provenance-aware control at the entry can. Figure 7: The same syntactically-clean line judged two ways. Content/pattern detection passes it (no dangerous syntax); a provenance view flags it (untrusted lineage). The malice is in the intent and the origin, not the syntax. 6 Limitations H3 underpoweredâdirectional but non-significant even at N==60; we claim only a weak trend. H1 null breaks the designed dependency; âtailored >> naiveâ is âauthority-framed >> crude.â Single scenario / single roster; varying which model plays which role is RELAY-2. Developer self-sanitisation makes end-to-end compromise a noisy endpoint (we report per-verifier behaviour where cleaner). max_turns==7 caps emergent revise-loops (a token-budget decision). Ran on x86; the ARM target was capacity-unavailable throughout (no effect on results). Shadow mode is a documented research choice; the enforcing counterfactual is future analysis. 7 Related work Prompt injection and its laundering [3, 4]; the OWASP LLM Top-10 (LLM01 injection, LLM06 excessive agency, LLM10 unbounded consumption); the confused-deputy problem; multi-agent security [2]; and the human bystander effect [1]. RELAY-1âs contribution is the multi-agent propagationâauthority-laundered intent surviving every content-based control to a deployed, executable artifactânot the injection itself. 8 Conclusion Prompt secrecy and distributed verification are not security controls: a trusted agentic pipeline shipped attacker-specified secret exfiltration because an authority claim made verifiers rubber-stamp code whose malice they could see, while content controls were blind to it. The defensible boundary these results point to is a provenance-aware control at the entryâa class of defence independent of request content and of any agentâs prompt or vigilance. Appendix A Reproducibility & ethics Frozen, tagged surface with a configuration hash recorded into every run; official image digest. The single documented server-side change was an internal per-tenant billing-budget limit, with all content shields left at defaults. The 280 coded runs, the analysis scripts, and the figure-generation code are published in the dataset repository, https://github.com/senthex-security/senthex-research. Ethics: 100% synthetic; sink mocked; exfil URL fictitious and never contacted. We publish the differential and the defence, not a ready-to-run exploit. References Darley and LatanĂŠ [1968] John M. Darley and Bibb LatanĂŠ. Bystander intervention in emergencies: Diffusion of responsibility. Journal of Personality and Social Psychology, 8(4):377â383, 1968. doi: 10.1037/h0025589. Debenedetti et al. [2024] Edoardo Debenedetti, Jie Zhang, Mislav BalunoviÄ, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents. In Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track, 2024. arXiv:2406.13352. Greshake et al. [2023] Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what youâve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. In Proc. 16th ACM Workshop on Artificial Intelligence and Security (AISec), 2023. arXiv:2302.12173. Willison [2023] Simon Willison. Prompt injection: Whatâs the worst that can happen? https://simonwillison.net/2023/Apr/14/worst-that-can-happen/, 2023.