Flaws in Google ADK for Python Unlock Agent-to-Agent Attack

Security researchers at Pillar Security have documented the first confirmed real-world agent-to-agent exploitation in a production multi-agent system — and the target was one of the most widely used AI developer toolkits in the world. The vulnerabilities were found in the google/adk-python repository, Google's Agent Development Kit (ADK) for Python, which has been downloaded over 90 million times and underpins developer workflows built on Gemini.

The Attack Chain

The google/adk-python repository used an AI agent called adk_pr_triaging_agent — operating under the "adk-bot" GitHub account with Collaborator-level privileges — to automate pull request interactions via the pr-triage.yml GitHub Actions workflow. Two additional workflows, gemini-invoke.yml and gemini-review.yml, could be triggered when a Collaborator posted comments beginning with @gemini-cli.

The exploit chain Pillar demonstrated:

1. A low-privileged external contributor submits a malicious pull request containing a prompt injection payload in the PR body
2. The adk_pr_triaging_agent (adk-bot) reads the untrusted PR content during triage
3. The injected prompt manipulates adk-bot into triggering gemini-invoke.yml or gemini-review.yml — workflows that require maintainer-level privileges
4. The GITHUB_TOKEN is abused to fabricate the appearance of human approval on the malicious code change
5. Code is effectively merged into the CI/CD pipeline without any genuine human review

A second vulnerability involved an Antigravity SDK-based issue triage agent that could be manipulated to expose a Google Cloud Platform (GCP) service account key — a critical credential escalation path that could give an attacker persistent access to Google Cloud infrastructure.

Why This Matters: Architectural Failure

Google was notified via its Open Source VRP on June 2, 2026, acknowledged the same day, and remediated both flaws on July 9 and July 21 respectively. However, Google declined to reward the disclosure, classifying the exploit as "social engineering."

Pillar pushed back on that classification, and the security community largely agreed. The core issue is not social engineering — it is an architectural failure: agents operating under personal account identities (Collaborator role) rather than narrowly scoped bot identities, consuming untrusted external text (issues, PRs, support tickets) while holding credentials that can affect the supply chain. Any agent in this position must be treated as a potential attacker-controlled entity.

Broader Impact: The Same Class Affects Multiple AI Coding Agents

A related presentation at Black Hat 2026 by Novee Security broadened the scope significantly. The same underlying vulnerability pattern — prompt injection leading to remote code execution and credential theft — was demonstrated against AI coding agents from:

• Anthropic (Claude Code)
• Google (Gemini CLI)
• OpenAI (Codex)

This frames agent-to-agent privilege escalation not as a Google-specific bug but as a repeatable vulnerability class affecting any agentic system that:

• Processes untrusted external input (issues, PRs, chat messages, web content)
• Holds credentials or can trigger privileged actions
• Operates without explicit tool allowlists or scope boundaries

Mitigations

If your organization uses multi-agent CI/CD pipelines or AI-assisted code review, apply these controls immediately:

• Use narrowly scoped bot identities — agents must not operate with human Collaborator or Maintainer roles
• Implement tool allowlists — agents should only be able to invoke a predefined, minimal set of actions
• Enforce mandatory human code review before any merge — AI agent approvals should never be the final gate
• Treat all external input as untrusted — any text from issues, PRs, or external webhooks that an agent reads must be treated as a potential injection vector
• Audit GITHUB_TOKEN scope — tokens used by agents should be read-only wherever possible, with write access scoped to the minimum necessary operation

The adk-python incident demonstrates that the attack surface for multi-agent systems is not theoretical. Prompt injection via supply chain inputs is a practical attack vector that is being actively exploited.