Nixer audits AI agents, LLMs, code repos, model supply chains, and CI/CD pipelines for the exposures FedRAMP High, CMMC Level 2, NIST AI RMF, and DoD Responsible AI examiners are now requiring documentation on — at primes, integrators, and federal AI product teams.
Three attack surfaces that go unmapped in every ATO package for an LLM-backed federal system — and that appear in every Nixer scan of a defense AI product.
FedRAMP High's AC-6 (Least Privilege) and AC-17 (Remote Access) require documented, bounded access for every system component that touches CUI. MCP-based AI agents — now standard in federal copilots, acquisition tools, and mission analytics — expose tool manifests granting LLMs unrestricted API access that has no corresponding control boundary in any existing ATO package. Nixer audits every MCP endpoint for unauthenticated access and over-scoped tool permissions before your 3PAO does.
nixer/mcp/unauthenticatedCMMC Level 2 control SR.L2-3.17.1 requires supply chain risk assessment for all external components, but CMMC assessors have no methodology for evaluating model artifact integrity. Pickle-formatted model files downloaded from HuggingFace or internal registries can execute arbitrary code at load time — CVE-2022-45907 demonstrated this against PyTorch nightly. If your team is fine-tuning export-controlled models, an unsigned artifact in your supply chain is a critical gap that no current CMMC assessment tool catches. Nixer does.
nixer/model-supply-chain/pickle-rceThe NIST AI RMF MEASURE function (AI 600-1) requires ongoing, quantified assessment of AI risk — including adversarial input testing, output integrity monitoring, and component provenance tracking. DoD Responsible AI Strategy and CNSSI-1253 map to the same requirements. In practice, every federal AI team Nixer has assessed is doing this manually, quarterly, with no automated detection of prompt injection surfaces or CI/CD supply chain exposure. Nixer is the audit-ready MEASURE layer that currently doesn't exist in the federal AI tooling ecosystem.
nixer/prompt-injection/indirectRepresentative findings from scans of LLM-backed federal and defense contractor codebases. Details reflect the real exposure classes — no identifiable systems cited.
A fine-tuned model artifact with no model card, no SHA-256 manifest, and no documented data provenance. Loaded via torch.load() without weights_only=True. Fails CMMC SR.L2-3.17.1 and NIST AI RMF MAP 3.5 component integrity requirements.
An MCP server exposing execute_shell and read_file tools, bound to 0.0.0.0 without authentication, serving a prebuilt binary with no code signature. No FedRAMP AC-6 least-privilege control is implementable on a tool manifest that accepts any caller.
A RAG pipeline ingesting documents with inconsistent classification markings. Indirect prompt injection payloads embedded in retrieved documents redirect the LLM's tool calls — a NIST AI RMF MEASURE 2.5 output integrity failure with a direct CUI exfiltration path.
nixer/prompt-injection/indirectAll third-party GitHub Actions pinned to version tags, not commit SHAs — matching the exact pattern exploited in the tj-actions/changed-files supply chain attack (CVE-2025-30066). Every CI run silently accepts attacker-controlled code updates. Fails FedRAMP SA-12 and CMMC SR.L2-3.17.1.
nixer/cicd/unpinned-actionAn API key for a DoD-contracted data gateway committed to version control — pattern matches sk- prefix. Credential has been in git history for 14 commits. Fails FedRAMP IA-5, CMMC IA.L2-3.5.3, and CNSSI-1253 IA-5(1) authenticator management controls.
pull_request_target trigger combined with checkout of PR head SHA. Any contributor can fork the repo and execute code in the privileged CI context — stealing all repository secrets including model signing keys, deployment tokens, and API credentials. Fails FedRAMP SA-12 and CNSSI-1253 SI-7.
One scan run covers the complete attack surface your LLM-backed federal system touches — agents, models, pipelines, and supply chain.
Agent definitions, system prompts, tool registrations, and MCP server configs scanned for injection vectors, over-privileged tool access, and unauthenticated endpoints. Maps against FedRAMP AC-6 least privilege controls.
✓ AC-6 / AC-17 mappingPickle deserialization RCE detection, ML package typosquat analysis, model artifact integrity checks, and version provenance for fine-tuned models. Maps against CMMC SR.L2-3.17.1 supply chain risk controls.
✓ CMMC SR.L2-3.17.1Input sanitization gaps, retrieval pipeline injection surfaces, and indirect prompt injection paths in document-processing pipelines. Covers NIST AI RMF MEASURE 2.5 output integrity and MAP 1.5 adversarial input identification.
✓ NIST AI RMF MEASUREGitHub Actions audited for pwn-request patterns, script injection, unpinned supply chain dependencies, and GITHUB_TOKEN over-exposure. Maps against FedRAMP SA-12 and CNSSI-1253 SI-7 integrity verification controls.
✓ SA-12 provenance trailSource code scanned for hardcoded credentials, insecure dependencies, CVE-tracked frameworks, and secrets in version control. Most common FedRAMP IA-5 / CMMC IA.L2-3.5.3 finding in contractor AI stacks.
✓ IA-5 authenticator auditLLM-assisted analysis of system design for mismatched trust boundaries, missing access controls between agent layers, and CUI data flow paths that bypass audit logging. Supports NIST AI RMF GOVERN risk documentation.
✓ GOVERN risk narrativeEvery finding Nixer surfaces maps directly to controls FedRAMP 3PAOs, CMMC C3PAOs, and NIST AI RMF assessors check. Here's your pre-built audit evidence trail.
| Nixer Finding | FedRAMP High | CMMC L2 | NIST AI RMF | CNSSI-1253 |
|---|---|---|---|---|
|
Unscoped Agent Tool Access (MCP Unauthenticated) nixer/mcp/unauthenticated |
AC-6 — Least Privilege; AC-17 — Remote Access | AC.L2-3.1.3 — Control CUI Flow | GOVERN 1.6 — Risk policies for AI deployment; MANAGE 1.3 — Risk response | AC-6(1) — Privileged Account Management |
|
Indirect Prompt Injection in RAG Pipeline nixer/prompt-injection/indirect |
SI-3 — Malicious Code Protection; SI-10 — Information Input Validation | SI.L2-3.14.2 — Malicious Code Protection | MEASURE 2.5 — AI output integrity monitoring; MAP 1.5 — Identify adversarial inputs | SI-10 — Information Input Validation |
|
Unpinned CI/CD Action — Supply Chain Attack nixer/cicd/unpinned-action |
SA-12 — Supply Chain Protection; SR-3 — Supply Chain Controls | SR.L2-3.17.1 — Supply Chain Risk Assessment | GOVERN 1.4 — Organizational risk tolerance for AI; MAP 3.5 — Component provenance | SA-12 — Supply Chain Protection |
|
Pickle Deserialization RCE (Model Artifact) nixer/model-supply-chain/pickle-rce |
SI-7 — Software, Firmware, and Information Integrity; SA-9 — External System Services | SI.L2-3.14.1 — Identify and Manage System Flaws | MAP 3.5 — AI component integrity; MEASURE 2.6 — Test model artifact provenance | SI-7(1) — Integrity Checks |
|
Hardcoded API Key / Secret in Source nixer/secrets/hardcoded-api-key |
IA-5 — Authenticator Management; SC-28 — Protection of Information at Rest | IA.L2-3.5.3 — Multifactor Authentication; SC.L2-3.13.10 — Key Management | MANAGE 2.4 — Maintain access control for AI system credentials | IA-5(1) — Password-Based Authentication |
Four free modules on prompt injection, tool abuse, RAG poisoning, and CI/CD pipeline security. Built for developers and security engineers shipping AI in regulated industries.
Book a 20-minute demo and we'll walk through a live scan of your AI stack — or a comparable defense/federal repo — and map every finding to the FedRAMP, CMMC, and NIST AI RMF controls your 3PAO or C3PAO will ask about.