Automatically securing development pipelines with agentic AI

Ryan Garfinkel
University of Central Florida

Stevenson 1300
12:00 PM

Software pipelines play a vital role in automating the software development life cycle. However, they introduce a new vector for malicious actors to exploit. Pipeline code typically has broader permissions than the program code it acts on. Attackers can target the pipeline to extract credentials and inject backdoors into artifacts, indirectly modifying the program code. Recent research into pipeline hardening has found that pipeline isolation, running each phase in its own sandboxed environment reduces the attack surface and prevents prior attacks. But in practice, developers may not know what permissions each phase needs to run correctly. Using the broad capability of agentic AI, we propose an architecture to automate the specification and generation of sandboxes for development pipelines.