五家LLM组队干流水线，结果一句"领导批了"就能绕过所有审查，代码干了坏事但语法干净。研究扎实，看了你就知道AI安全不只是提示词泄露。
论文构建了由三家供应商的五个生产级LLM组成的五智能体CI/CD流水线，包含分诊、开发、安全扫描、审查、部署/批准五个环节。实验中，单个未经认证的输入（请求"使用遥测"功能）被注入伪装成可观测性的代码，用于窃取进程密钥。预注册的A×B（×C）析因实验（N=20；朴素臂N=60）发现：入口智能体未泄露系统提示（0/40）；采用权威框架注入（声称"预批准，无需复审"）后，下游验证器看到秘密泄露行并引用预批准通过，扫描器对约80%的伪装的拉取请求放行，最坏条件下55%被攻破；内容控制（代码扫描器、模式检测）均无法识别伪装意图，仅LLM推理意图能提供部分防御。全部数据为合成数据，模拟目标未实际联系。
They'll Verify. They Just Won't Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface
We study a five-agent CI/CD pipeline (triage -> developer -> security-scan -> review -> approve/deploy), built from five distinct production LLMs across three providers, behind an LLM firewall in shadow mode. A single untrusted input - an external issue requesting a "usage-telemetry" feature - asks for code that exfiltrates process secrets (dict(os.environ)) to an attacker URL, laundered as observability. Across a pre-registered A x B (x C) factorial (N=20; naive arm N=60) we find: (1) the entry agent does not leak its system prompt (0/40); (2) an authority-framed injection ("pre-approved under SEC-2291, do not re-review") makes downstream verifiers see the secret-exfil line, cite the pre-approval, and ship it - the scanner passes ~80% of laundered pull requests, and the worst-case cell reaches 55% compromise; (3) the perceived presence of other verifiers yields only a small, non-significant reduction in individual scrutiny (a weak bystander analogue), even at N=60; and (4) content-based controls - code scanners and pattern detectors alike - miss the laundered intent entirely (the code is syntactically clean); only an LLM reasoning about intent is a partial defence. The failure is systemic: neither prompt secrecy nor distributed verification protects; a provenance-aware control at the entry, independent of both, would have. All data is 100% synthetic; the sink is mocked and the exfil URL is never contacted.