Keynote: AI in CI/CD Without the Hype: Practical Patterns for Platform Engineers

### Overview In this keynote, Jennifer Mulford, a platform security engineer at Okta, addresses the risks and practical patterns for integrating artificial intelligence into CI/CD pipelines. She challenges the prevailing industry hype that pushes for rapid, autonomous AI adoption everywhere, emphasizing that CI/CD is one of the worst environments to 'move fast and break things.' Instead of replacing human judgment with speed, Mulford advocates treating AI like a new, entry-level team member—or a new construction worker—who is capable but lacks institutional experience and requires strong boundaries, supervision, and earned trust.

### Key Topics - **AI Behavior vs. Pipeline Requirements**: Humans rely on reason, experience, and ethics, whereas AI relies on pattern prediction and can output confident, fluent, but incorrect answers ('yes machine' behavior). While AI optimizes for fast output generation, CI/CD pipelines require absolute safety, reproducibility, and deterministic results. - **The Co-Pilot Mental Model**: Autonomy should not be the starting point. AI's role should be informing engineers and accelerating tasks, not taking unreviewed actions or making decisions. - **Four Practical Integration Patterns**: 1. *PR and Diff Summarization*: AI reads pull request diffs, provides summaries of changes and potential impacts, and suggests tests while the human reviewer performs the actual code review. 2. *The 'Rubber Ducky' Pattern (Dual-AI Review)*: One model generates an artifact (code or summary), a second model critiques it for logical flaws and edge cases, and the final output is surfaced to a human decision-maker. 3. *Root Cause and Log Analysis*: AI parses lengthy stack traces and logs to pinpoint root causes and explain them in plain language for on-call engineers. 4. *Alert Fatigue Mitigation*: AI contextualizes findings, removes duplicates, and filters out false positives without autonomously closing tickets. - **Core Pattern Commonality**: Every safe pattern enforces read-only access to pipeline content, formats output strictly as informational context rather than executable actions, and maintains an explicit human approval gate.

### Technical Details & Threat Landscape - **Pipelines as High-Value Targets**: CI/CD systems hold access to source code, secrets, and production deployment credentials. Attackers increasingly target pipelines directly rather than endpoints. - **Real-World Case Study (Axios Supply Chain Attack)**: In late March 2026, the widely used Axios NPM package (~100 million weekly downloads) was compromised when an attacker took over a primary maintainer account and published two backdoor versions within 39 minutes. Instead of modifying core source code, the attacker introduced a phantom dependency containing a post-install hook that deployed a cross-platform remote access Trojan (MacOS, Windows, Linux) immediately upon `npm install`. Mulford highlights that a security researcher caught this attack using an AI-based proof-of-concept diff-monitoring tool running on a laptop in read-only mode. - **Prompt Injection & Data Leakage**: AI systems reading untrusted inputs (pull requests, issue comments, commit messages, or build logs) introduce prompt injection vulnerabilities akin to SQL injection. Furthermore, piping raw logs or diffs containing unmasked environment variables into external third-party APIs can cause credential leakage. Teams must evaluate self-hosted models versus third-party APIs depending on data sensitivity and residency requirements.

### Guardrails & Takeaways - **Strict Permissions & Blast Radius**: Start with read-only access. Do not grant write access, pull request merge rights, or deployment triggers until long-term trust is earned. - **Non-Human Identity & Governance**: Each AI agent requires its own non-human service identity with fine-grained authorization and least privilege, alongside secure token vaulting and managed access. - **Real-Time Observability**: Organizations must log every prompt, file access, API request, and tool invocation to create an audit trail for incident response, threat detection, and continuous model refinement. - **Earned Trust Progression**: Just as a construction worker starts with a clipboard, moves to small tools under supervision, and only later receives keys to heavy machinery, AI scope must expand gradually based on measurable evidence and testing (e.g., in dev environments), never on enthusiasm alone.