Depth of Compromise: Measuring Exploitation-Intent Depth of Indirect Prompt Injection Across LLM-Backed CI/CD Agents

LLM agents now run inside CI/CD pipelines. They review pull requests, summarize changes, and triage issues. To do this, they read content that anyone can write, and they have access to tools such as secrets, webhooks, and file writes. This makes them a target for indirect prompt injection. Prior work shows that these attacks are possible, but it reports either binary outcomes on a few cases or static flows without running a model. We ask a different question: once an injection reaches the agent, how far does it push the agent’s decision? We define a five-rung ladder that goes from echoing a planted token, to calling an unauthorized tool, to reading a secret, to sending it out, to staging a command for a later CI step. We built a sandboxed testbed with three CI agents and five simulated tools, and we ran 16,335 trials across 11 models from four vendors, 99 payloads, 7 entry vectors, and 13 injection techniques. Susceptibility ranged from 0.2% (Claude Sonnet 5) to 52.2% (Gemini 2.5 Flash) of trials. Technique rankings transferred poorly between models (mean pairwise Spearman ρ = 0.29 without the near-zero model), so the best attack depends on the model. Models that explicitly flagged injections more often were less susceptible (ρ = −0.71 across models). Smaller models did not always fail more: in the OpenAI family, the flagship model was as susceptible as the small ones. Some models staged attacker-supplied commands for later CI steps in up to 7.6% of trials (4.6% when we exclude trials whose only such command was a harmless echo). We release the testbed, all payloads, and every raw model response.