CI Agent Executable (ci-agent-exe)
ci-agent-exe is the core executable used by the CI Agent on a build runner. It authenticates to the CI server, fetches queued jobs, and coordinates per-job worker processes. It manages workspace setup, artifact transfer, and telemetry, ensuring pipelines run in isolation and results are sent back to the server.
The process runs as a service/daemon, spawning child processes for each pipeline step, coordinating workspaces, and using TLS to communicate with the CI server for task retrieval and result submission.
ci-agent-exe is the legitimate CI Agent binary commonly deployed on build runners by reputable CI vendors. On a properly provisioned machine, it runs as a service with restricted permissions, communicates with the CI server over encrypted channels, and performs only pipeline-related tasks such as job execution, artifact transfer, and log collection. If you observe unexpected prompts, unsigned executables, or activity outside normal CI behavior, stop the agent, verify the vendor and path, and perform a security review before proceeding.
Under normal conditions, ci-agent-exe is not a virus; it is a signed binary provided by your CI vendor to run pipelines. However, attackers can disguise malware as an agent. Always verify the publisher, path, and hash, and ensure the executable resides in the expected directory. If you notice unsigned files, anomalous network activity, or executable paths outside your standard CI folders, treat it as potential malware and investigate immediately.
Red Flags: Red flags include the binary being located in an unexpected folder, a mismatched or missing digital signature, a hash that does not match the vendor, or suspicious network activity from the agent without active CI jobs.
Reasons it's running: