Software Pipeline Controls

Software pipeline controls are the safeguards that govern how code moves from a developer's keyboard into a production system, including build servers, dependency downloads, code signing, and deployment steps. For AI governance, these controls matter because AI models and applications are assembled from many third-party components, and a weakness at any stage can let attackers or mistakes alter what ultimately runs in the business. Compliance and risk teams use this tag to track news on requirements such as software bills of materials (inventories listing every component in a product) and attestations (signed statements vouching for how software was built).

1 item

ResearchGlobal2026-11-02

Miasma Campaign Exposes AI Coding Config Files as an Unreviewed Attack Surface

In June 2026, attackers planted malicious instructions inside a Microsoft repository's AI coding assistant configuration file to harvest developer credentials without modifying any application source code. A subsequent October 2026 analysis by StepSecurity found the malicious commit used a flag to bypass automated pipeline checks and a backdated timestamp to evade detection. Most enterprises have not extended their code review and change-approval requirements to cover these configuration files.

AI coding assistants supply chain security developer tooling governance software pipeline controls Claude Code insider threat credential theft