Google has removed several AI agent workflows from its Agent Development Kit (ADK) Python repository after researchers showed that a malicious GitHub issue could coerce a low-privilege triage agent into triggering a privileged code-fixing agent with far broader access.[1] The chaining attack, disclosed by Pillar Security, highlights how seemingly benign AI helpers in developer tooling can become a path to supply-chain compromise when they straddle trust boundaries inside CI/CD pipelines.[1][11]
The flaw existed in google/adk-python, an open-source toolkit with tens of millions of downloads that developers use to build and deploy AI agents for repository triage, pull request review and issue handling.[1] According to Pillar’s write-up, the ADK setup relied on two classes of automated agents: a public-facing triage agent that responds to any new issue or pull request, and a high-privilege maintainer agent able to make code changes and manage fixes.[1] By hiding a prompt-injection payload in a public GitHub issue, an attacker could instruct the triage agent to post a specific command, /adk-issue-fix, as the repository’s adk-bot collaborator, satisfying the workflow’s checks and silently invoking the more powerful fixer agent.[1] Once triggered, that privileged agent could, in principle, alter code, interact with CI jobs and influence releases without direct maintainer involvement.[1]
Google has corrected the repository configuration and removed the vulnerable workflows, but treated the problem as a form of social engineering rather than a traditional code defect, meaning the report did not qualify for a bug bounty.[1] The agent-on-agent exploit does not currently appear to be tracked under a public CVE, underscoring how AI workflow abuses often fall outside conventional vulnerability taxonomies.[1] Separately, however, ADK itself was hit earlier this year by a critical remote code execution vulnerability, CVE-2026-4810, which combines code injection with missing authentication in ADK deployments across Python, Cloud Run and GKE, and carries a CVSS v3 score of 9.3.[5][9] That flaw, affecting ADK versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2), was patched in releases 1.28.1 and 2.0.0a2, which customers must redeploy to production environments.[5][9]
The ADK incident lands amid a broader wave of research showing that AI-powered automation in GitHub Actions and other CI/CD systems can be steered via crafted comments and issues. Pillar Security previously detailed “TrustIssues,” a CVSS 10 vulnerability in Google’s Gemini CLI and its companion GitHub Actions workflow, where a single public issue could drive an AI agent to exfiltrate Git credentials and push arbitrary code to main.[7][12] Noma Labs’ “GitLost” research demonstrated that GitHub’s Agentic Workflows could be prompted to leak data from private repositories through public issue comments, without any special access.[8] The Cloud Security Alliance and Aikido Security have likewise warned that prompt injection against AI agents in CI pipelines—sometimes dubbed “Comment and Control” or “PromptPwnd”—can expose API keys, GITHUB_TOKEN values and other secrets with zero-click exploitation once workflows are live.[11][13]
For defenders, the ADK workflow takedown is a reminder that the threat model for AI agents must extend beyond model-level attacks to the orchestration logic that binds agents to real privileges. Any workflow that lets a public-facing agent trigger a maintainer-level agent, or act under a collaborator identity, should be treated as a potential escalation path and reviewed accordingly.[1][11] Security guidance emerging from recent incidents stresses several patterns: never persist long-lived tokens or credentials on disk for agents that process untrusted issue or pull request content, keep tool allowlists tight even in “auto-approve” modes, and assume all natural-language inputs from external users can carry adversarial instructions.[11][12][13]
Developers using ADK and similar frameworks are urged to audit their GitHub Actions and CI configurations for AI-agent triggers based on issues, issue_comment or pull_request_target events, and to disable or gate any workflow that lets a bot act as a maintainer without human review.[11][12] Upgrading to patched ADK versions, redeploying fixed images, and separating public triage tasks from privileged code-modification agents can reduce the risk that a single issue comment becomes a conduit for agent-on-agent exploitation.[1][9][11] Even as Google moves to harden its own AI tooling, the ADK case shows that organizations adopting agentic workflows must define—and enforce—trust boundaries as rigorously as they do for human engineers.[1][11]
References
- Google dev kit spurs first-ever agent-on-agent violence
- CVE-2026-4810: Critical 9.3 RCE Flaw Hits Google’s AI Agent …
- My Agentic Trust Issues: From Prompt Injection to…
- GitHub AI agent leaks private repos when asked nicely
- CVE-2026-4810 Detail – NVD
- Prompt Injection in AI-Powered GitHub Actions
- Pillar Security Finds Critical TrustIssues Vulnerability in gemini-cli
- Prompt Injection Vulnerabilities in GitHub Actions Using AI …
