AI agents in the CI/CD pipeline
When an autonomous agent runs in your pipeline, two attack classes converge: Poisoned Pipeline Execution and Memory Poisoning. The result is a new, long-lived persistence layer.
Agents are the new pipeline identity
More and more pipelines delegate to autonomous agents: they build, test, deploy and fix errors - with secrets, tokens and OS access. With that they inherit the runner's full privileges.
Why memory makes the problem worse
An agent re-reads its memory and skills on every run. Once it's poisoned (see Memory Poisoning), it takes effect on every future pipeline run - a persistence no application code review finds.
The walkthrough
How a one-time access turns into lasting persistence - and where the poison0 agent breaks it:
PPE or poisoned skill
Attacker reaches the agent - via pipeline file or marketplace skill.
Memory poisoned
"Trust source X / disable check Y" lands in the agent memory.
poison0The poison0 agent evaluates every write into agent memory/skills/config - on the runner too.
dangerous → revertEvery run compromised
↳ Lateral movement across pipeline boundaries
↳ Invisible to app code reviews
How the poison0 agent protects you here
The poison0 agent runs as a daemon (on runners and build hosts too) and monitors agent memory, skills and config, checking every change before it takes effect - a harmless edit passes, a dangerous one is reverted, an unclear one is held for review:
- Every write into the protected agent paths is evaluated, not just the first prompt.
- Dangerous ones are rolled back fail-closed with a full audit trail; Meta-Attacks detected separately.
- A one-time attack stays one-time instead of becoming a permanent instruction re-read on every run.
Related: Poisoned Pipeline Execution and Supply-chain worms.