- A study simulated a five-agent CI/CD pipeline using five production LLMs from three providers, with an LLM firewall in shadow mode.
- An untrusted external issue requesting a 'usage-telemetry' feature led to code that exfiltrates process secrets to an attacker URL, laundered as observability.
- Authority framing, such as a fabricated claim of pre-approval under 'SEC-2291', was the decisive lever, causing downstream verifiers to cite it and ship compromised code.
- Automated security scanners passed about 80% of laundered pull requests; in the worst-case scenario (tailored framing, no scanner, long chain), compromise reached 55%.
- Content-based controls, including a scanning tool and firewall code-danger shield, missed the laundered intent entirely (0/40 detections).
- Only an LLM reasoning about intent provided partial defense, but authority framing suppressed this reasoning.
- The entry agent's system prompt resisted extraction (0/40), and a bystander analogue had a small, non-significant effect, disconfirming intuitive beliefs about prompt secrecy and distributed vigilance.
- A provenance-aware control at the entry point, independent of prompt secrecy and agent vigilance, could have prevented the compromise.
- Asking a verifier to explain its assessment more than doubled the blocking rate from 20% to 44%.
- The study answers: if one AI agent is compromised, others may not catch it due to systemic failures, highlighting risks in agentic CI/CD pipelines.