In brief: A publicly manipulable triage agent in the Google ADK repository could be exploited via prompt injection to trigger a code-modifying agent under the identity of a privileged bot, prompting Google to remove three affected workflows.
Google has removed three AI agent workflows from the Python repository of its Agent Development Kit (ADK). Security researchers at Pillar Security showed that a publicly accessible triage agent could be manipulated via a crafted GitHub Issue into triggering a privileged code-fixing agent.
Researchers at Pillar Security demonstrated that a public triage agent in the ADK repository could be induced, via prompt injection, to post the command “/adk-issue-fix” as a comment under the identity of the bot “adk-bot”. Because the bot was listed as a collaborator in the repository, this comment automatically satisfied the permission check that was actually meant to require a human maintainer with write access. As a result, an attacker could use a simple, publicly submittable GitHub Issue to trigger a second, privileged agent that makes code changes.
The mechanism exploited the chaining of two agents: a triage agent accessible to anyone processes incoming issues automatically, while a downstream fix agent with elevated privileges performs actions in the repository based on that input. The inheritance of permissions via the bot identity was therefore the actual vulnerability, rather than a classic single software bug. For security leaders, the case illustrates a structural problem in multi-stage agent pipelines: trust boundaries between a publicly exposed entry-point agent and a privileged downstream agent can be deliberately undermined via prompt injection as soon as authorization is tied to an identity rather than to an actually verified human action.
Google responded by removing three affected workflows from the ADK Python repository. The report does not specify whether additional hardening measures were implemented, such as a stricter separation of trigger and execution privileges or a revised identity verification process for bot comments. Organizations using ADK or comparable multi-stage agent architectures with automated GitHub integration should check whether bot accounts are granted collaborator or write access, and whether comments or commands triggered by publicly reachable agents actually distinguish human-authorized actions from automated trigger chains.
Source: thehackernews.com · Published August 4, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.