Abstract
<title>Abstract</title> <p>Context: The integration of Generative AI (GenAI) into Continuous Integration/Continuous Deployment (CI/CD) workflows is accelerating the automation of software delivery in cloud-native environments. Problem: However, a fundamental misalignment exists between the probabilistic nature of AI-generated artifacts and the deterministic, signature-based logic of traditional security tools. This discrepancy creates potential "blind spots" where syntactically correct but insecure code bypasses validation gates. Aim: This study empirically investigates and quantifies the detection failure rate of standard DevSecOps tools against stochastic vulnerabilities introduced by local Large Language Models (LLMs). Methodology: We conducted a controlled experiment using a local LLM (Code Llama) integrated into a GitLab pipeline deploying to Kubernetes. Through repeated independent runs, we simulated two injection scenarios: Logic Flaws (Broken Access Control) and Infrastructure Configuration Drift. Results: Empirical statistical analysis reveals that widely used deterministic scanners consistently failed to detect the syntactically valid yet insecure artifacts, confirming a systemic inability to identify context-dependent AI flaws. Conclusion: These findings demonstrate that current deterministic defenses are insufficient for GenAI-driven pipelines. The study highlights the urgent need for a paradigm shift towards intent-aware verification and probabilistic security frameworks to mitigate the risks of "silent decay" in automated software supply chains.</p>