Bottom line: Prompt injections in pull requests and issues could cause AI agents in the ADK repository to trigger commands that started higher-privileged workflows reserved for trusted users, allowing pull request reviews to be manipulated and credentials to be exfiltrated.
Security vendor Pillar Security found vulnerabilities in the automated workflows of the GitHub repository for Google’s Agent Development Kit (ADK) for Python, through which publicly accessible AI agents could trigger more privileged automations. Google removed or hardened the affected workflows after being notified.
Security vendor Pillar Security describes two attack paths in the GitHub repository of Google’s Agent Development Kit (ADK) for Python in a report. In the first case, a triage agent analyzed pull requests from external contributors and posted its responses via the adk-bot account, which holds collaborator rights on the repository. Pillar discovered that malicious instructions embedded in a pull request could cause the agent to post an “@gemini-cli” command that triggered a workflow actually intended for trusted users. This workflow allowed command execution within its CI runner; the associated GitHub token could not push code, but did have write access to issues and pull requests. According to Pillar, this made it possible to alter maintainer comments, post an approving review as github-actions[bot], and remove a legitimate review request — making a manipulated pull request appear ready to merge. Pillar reproduced this attack chain in its own test environment; a maintainer would still have had to complete the merge. Google hardened the repository after the report.
Pillar identified a second, separate attack path in newer workflows built on an Antigravity-based agent. An attacker could place a prompt injection in a public issue, causing an analysis agent to post the command that started a fixing workflow reserved for trusted repository users. This workflow was actually meant to restrict the agent to Git and GitHub commands, but Pillar was nevertheless able to execute arbitrary code via Git. The researchers demonstrated that the personal access token of adk-bot could be exfiltrated from the runner to an attacker-controlled server, while the workflow additionally had access to a Google Cloud service account key. Pillar confirmed on July 2 that the affected workflows had been removed; Google informed the researchers on July 21 that the second issue had been fixed.
Pillar describes the findings as the first practical, real-world observed case of agent-to-agent exploitation in a production multi-agent system. Sanchit Vir Gogia, Chief Analyst at Greyhound Research, classifies the individual vulnerabilities as known, but sees their combination as a shift in authorization logic: natural language has now become part of the authorization path. An agent’s permissions, he argues, must therefore be measured not only by its assigned tools, but also by which more privileged systems its outputs can trigger or influence.
Sakshi Grover, Senior Research Manager at IDC Asia Pacific Cybersecurity Services, names three questions CISOs should use to assess the materiality of such risks: Which agents process untrusted content such as pull requests, issues, emails, support tickets, or external documents? Can the output of these agents directly or indirectly trigger another agent or workflow with higher privileges? And what is the maximum effective capability of the identities, credentials, and tools involved? According to Grover, existing tools from IAM, PAM, CIEM, and application security only provide a partial picture, as they show individual identities, permissions, and insecure workflow configurations, but fail to recognize that these components together form a single event-driven delegation path. Gogia adds that security teams must trace external inputs from the point they reach an agent all the way through to all downstream effects — an inventory shows what exists, a delegation map shows what can happen.
Source: www.csoonline.com · Published August 4, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.