Shadow AI in your pipeline is a non-human identity problem, not a chatbot problem

Shadow AI — AI tools in the software lifecycle without approval, ownership, or monitoring — has a new threat model from CNCF. It's a good one, and the framing shift matters. The moment AI stops advising and starts acting, it stops being productivity software. "Once an AI system is allowed to call tools and take actions, it stops being productivity software and becomes a new non-human identity with permissions, a blast radius, and a place in your threat model." That's the sentence to share with your security team. What the threat model covers The CNCF post maps Shadow AI risk across the full delivery path: Developer laptop — unapproved extensions or public chatbots leaking source code, secrets, or internal hostnames Source control — AI bots with org-wide repo access, no clear owner, ripe for prompt injection via malicious issues or PR descriptions CI pipeline — AI that reads logs and "fixes" builds now has access to your most powerful credentials: source-control tokens, cloud keys, signing keys Artifact registry — AI-suggested packages and base images with no provenance check, no SBOM, no review CD platform — an AI agent that can approve releases, edit Helm charts, or trigger rollbacks can bypass your entire change-management process Kubernetes runtime — a remediation agent granted cluster-admin "temporarily" is now a high-value target with broad blast radius Each stage is an injection point. A small convenience decision at the laptop stage can become a production exposure at Kubernetes. The key insight Prompt injection is the through-line. Agents routinely read untrusted content — issue descriptions, READMEs, build logs. Any of it can steer an agent into disclosing data or taking unsafe actions. That's why perimeter controls alone won't save you. The workable model is simple in principle: every agent has a human owner, a unique identity, least-privilege access, and monitoring on what it actually does. The CNCF post maps specific CNCF projects to each stage — Falco, SPIFFE/SPIRE, Cosign, Kyverno — as concrete controls, not just recommendations. The blast radius table is the part worth bookmarking: code explanation needs developer training; CI/CD pipeline modification needs isolation, policy-as-code, and an approval gate; autonomous production changes require exceptional approval, time-bound access, and a kill switch. What to do Build an AI inventory now. Name every AI tool, extension, agent, and MCP server in use. Assign a technical owner. You can't govern what you can't see. In the CI pipeline? No long-lived secrets in prompts or logs. Ephemeral credentials only. AI-connected jobs in isolated environments. In Kubernetes? Namespace-scoped RBAC, never cluster-admin. SPIFFE/SPIRE for workload identity. Falco or Tetragon for runtime detection. On CD? Draw the hard line: agents propose changes, humans approve them. GitOps + PR as the gate. No direct-to-production path that skips the gate. Starting from scratch? The CNCF post has a controls matrix mapped by blast radius — use it as your checklist. Read the full threat model: CNCF Blog — Shadow AI in CI/CD ✏️ Drafted with KewBot (AI), edited and approved by Drew.