A build agent is a worker machine or service that receives jobs from a CI/CD server and executes them. It may compile code, run tests, package artifacts, or deploy software. The server usually orchestrates the workflow, while the agent performs the actual build steps in an isolated or semi-isolated environment.
Build agents matter because they often handle source code, credentials, signing keys, and deployment tokens. If an attacker compromises the CI/CD server, a malicious job can be pushed to agents, turning them into execution targets. Defenders reduce this risk with least privilege, strong agent authentication, network segmentation, and separate hosts for the control plane and workers. Limiting what agents can access helps contain damage if a build job or server is abused.