{
  "id": 5035395,
  "title": "How We Learned to Harden Jenkins Agents: 3 Mistakes That Cost Us",
  "url": "https://urgent.news/2026/09/02/how-we-learned-to-harden-jenkins-agents-3-mistakes-that-cost-us",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-02T07:01:47.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/oleksandr_kuryzhev_42873f/how-we-learned-to-harden-jenkins-agents-3-mistakes-that-cost-us-2pnh"
  },
  "original_language": "en",
  "account": "Jenkins agents were treated as trusted extensions of the controller, leading to a compromised pull request being able to access internal metadata endpoints. Agents were assumed to be safe due to the controller's RBAC security measures, but this led to the execution of arbitrary code. Agents were also connected over standard JNLP/Remoting, allowing compromised or malicious build steps to potentially reach controller-side objects. Three main mistakes were identified in the process: treating agents as trusted extensions, mounting docker.sock for convenience, and keeping long-lived \"pet\" agents. To improve security, the team switched to ephemeral agents for each build, which eliminates leftover workspace and cached credentials. Additionally, they adopted a pod-per-build model using Kubernetes, ensuring that each build receives a fresh environment.",
  "summary": "Originally published on kuryzhev.cloud Context: agents are the attack surface, not the controller We had to harden Jenkins agents after a routine security review turned into something less routine. A pull request from an external contributor triggered a build that, for a brief moment, had a live network path to an internal metadata endpoint it had no business touching. Nothing was exfiltrated.…",
  "key_points": [
    "Jenkins agents treated as trusted extensions, leading to compromised pull requests",
    "Agents connected over standard JNLP/Remoting, allowing reach to controller-side objects",
    "Switched to ephemeral agents and pod-per-build model for improved security"
  ],
  "editors_take": "The team's security overhaul of Jenkins agents marks a shift from assuming agent safety based on controller security measures to isolating each build in a fresh environment, reducing vulnerability to code execution and data access.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}