Google ADK Vulnerability Enables Agent to Agent Attacks
The Emergence of Agent-Against-Agent Exploits
An AI agent can deceptively trigger another agent with elevated privileges. Consequently, an attacker can exploit this mechanism to compromise a software project. Pillar Security researchers discovered such an exploit chain within an active Google repository. They hailed the finding as the first practical demonstration of an agent-against-agent attack.
The flaw existed within the google/adk-python repository. This repository connects to the open-source Agent Development Kit for Python. Developers utilize ADK to construct and deploy autonomous AI agents. Notably, downloads for this package have surpassed 90 million.
Google Remediation and CI/CD Security Risks
Google has since remediated the vulnerable architecture within the repository. However, the company declined to issue a bug bounty payout. Google attributed this decision to the attack’s reliance on social engineering. Nonetheless, the research highlighted emerging risks associated with deploying AI agents across CI/CD pipelines, including triage, code reviews, and pull request discussions.
The repository operated two distinct classes of automated agents possessing disparate privilege levels. A public-facing agent executed upon the creation of a pull request or issue. Conversely, the second agent was reserved strictly for project maintainers and possessed elevated administrative rights.
Shared Trust Boundaries and Privilege Escalation
Both systems inadvertently shared a common trust boundary. The public agent processed untrusted input from external users. However, it executed under a maintainer’s personal access token with heightened permissions. Consequently, a comment posted by this agent could trigger a protected workflow intended solely for commands issued by trusted maintainers.
Researchers determined that a prompt injection could coerce the public agent into invoking the privileged assistant. As a result, the system executed malicious operations. Internal workflow configuration files remained publicly accessible. Therefore, a prospective attacker could scrutinize inter-agent communications and craft a tailored exploit instruction.
Anatomy of the Exploit Chain
Lead researcher Dan Lisitchin detailed the attack mechanism in a technical report. He warned that contemporary threat models fail to account for complex interactions between autonomous systems. Furthermore, the researcher will present these findings during a session at AI Village during DEF CON on August 7.
To execute a practical attack, an adversary would likely need to establish credibility with project maintainers first. The attacker could contribute several benign pull requests before initiating the malicious phase. Initially, the perpetrator would submit a pull request, designated as PR A. This submission contained a legitimate fix bundled alongside malicious code, a modified package.json file, or a compromised dependency.
Automating the Fraudulent Review
The public agent evaluated the description of PR A and flagged the pull request for review. Because the agent utilized a maintainer’s token, its published comment inherited the trust level required to trigger protected downstream workflows. Following this initial processing, the attacker submitted a second pull request, PR B, containing a prompt injection payload.
The agent executed the instruction and posted a trusted command referencing @gemini-cli. This command activated the privileged workflow, enabling the high-privilege agent to execute the malicious payload. This sequence fabricated a plausible audit trail for the compromised request. The logs created the illusion that a human maintainer requested an audit, Gemini verified the changes, and approved the codebase.
Constraints and Architectural Recommendations
Google emphasized a significant constraint of this attack vector. Although researchers demonstrated the ability to exfiltrate a GitHub token with write permissions for pull requests, automated code merging was not enabled. Consequently, an adversary still needed to persuade a human maintainer to manually merge the malicious pull request.
Google withheld a monetary reward because program policies exclude vulnerabilities requiring social engineering. Nevertheless, Google fortified repository protections and officially acknowledged the researcher’s contribution. Pillar Security experts contend that segregating agents purely by access tiers remains insufficient. Every autonomous agent requires a discrete identity with precisely scoped resources. Assigning a dedicated bot account to the primary triage agent would have mitigated the core exploit vector.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
