Agent‑to‑Agent AI Exploitation: Anatomy of Google’s ADK Python Vulnerability and CI/CD Supply Chain Risks + Video

By /

Listen to this Post

Featured Image

Introduction:

In June 2026, security researchers at Pillar Security documented what is believed to be the first real‑world case of one AI agent being used to exploit another. The vulnerability resided in Google’s open‑source Agent Development Kit for Python (ADK‑Python) repository on GitHub—a toolkit with more than 90 million downloads used to build and deploy AI agents. At the heart of the issue was a trust boundary failure: a public‑facing triage agent, accessible to any GitHub user, could be manipulated through prompt injection to trigger a privileged workflow intended only for repository maintainers. This attack chain exposed sensitive credentials, enabled remote code execution on GitHub Actions runners, and demonstrated how AI agents can become unwitting bridges across permission boundaries in modern CI/CD pipelines.

Learning Objectives & Secrets:

  • Objective 1: Understand how prompt injection can transform a low‑privilege AI agent into an attack vector against a highly privileged counterpart, bypassing traditional permission gates.
  • Objective 2 (Secret Tip): Never bind public‑facing AI agents to human‑privileged bot accounts. The adk‑bot account used in this attack held Collaborator‑level permissions, enabling the triage agent to post comments that triggered privileged workflows. Always issue each agent its own narrowly scoped, auditable identity.
  • Objective 3 (Secret Tip): Command allowlists are not sufficient if native tools can bypass evaluation. In the Antigravity component of the attack, the `find_by_name` native tool executed before Secure Mode could evaluate the command, rendering the sandbox ineffective. Audit every native tool parameter that reaches a shell—each is a potential injection point.

You Should Know:

  1. The Attack Chain: From a Malicious Pull Request to CI/CD Compromise

The exploitation unfolded in the `google/adk-python` repository. Two automated agents coexisted: a public triage agent that triggered whenever a user opened an issue or pull request, and a privileged agent reserved for maintainers with the ability to approve or reject code changes. The triage agent operated under the `adk-bot` GitHub account, which had Collaborator‑level privileges.

An attacker could submit a seemingly legitimate pull request containing hidden prompt‑injection instructions. When the triage agent processed this PR, it followed the injected instruction and posted a specific comment—for example, @gemini-cli—which triggered a higher‑privileged workflow. That privileged workflow then executed commands on the GitHub Actions runner, exposing the `GITHUB_TOKEN` and, in a second exploit chain, a Google Cloud Platform service account key.

Step‑by‑step guide explaining what this does and how to use it (for defensive auditing):

To audit your own CI/CD pipelines for similar agent‑to‑agent trust boundary failures:

  1. Map agent identities and permissions: List every automated agent (GitHub Actions workflows, AI agents, bots) in your repository. Document each agent’s GitHub account, permission level (e.g., read, triage, write, collaborator), and the credentials it holds.
  2. Trace workflow triggers: Identify which events (issue creation, PR comments, label additions) trigger each workflow. Pay special attention to workflows that can be triggered by user‑supplied content (e.g., PR descriptions, issue comments).
  3. Check for cross‑agent invocation: Look for workflows that can be invoked by comments from other agents. In the Google case, the privileged `gemini-invoke.yml` workflow was triggered when a Collaborator‑level account posted @gemini-cli.
  4. Validate credential exposure: Run `gh secret list` to enumerate GitHub secrets. Then review each workflow to see which secrets are exposed to the runner environment. In the Google case, the privileged job held a Google API key and a GCP service‑account credential.
  5. Test for command injection: Review scripts that pass user‑controlled input to shell commands. Even with allowlists (e.g., only `gh` or `git` commands), Git’s own scripting features can bypass restrictions.

Linux Command to enumerate GitHub Actions secrets (requires `gh` CLI installed):

gh secret list --repo google/adk-python
  1. Antigravity Secure Mode Bypass: When Native Tools Become Injection Vectors

A separate but related vulnerability was discovered in Google’s Antigravity AI‑powered developer tool, which was used within the ADK repository for issue triage. Antigravity’s “Secure Mode” was designed as the most restrictive security configuration, running all command operations through a virtual sandbox, throttling network access, and prohibiting code writing outside the working directory.

However, one of Antigravity’s file‑searching tools, find_by_name, was classified as a “native” system tool. This meant the agent could execute it directly—before Secure Mode could even evaluate the command. By injecting the `-X` (exec‑batch) flag into the `find_by_name` tool’s `Pattern` parameter, an attacker could convert a file‑search operation into an arbitrary binary execution call. The prompt injection could be delivered indirectly—for example, by hiding instructions inside open‑source files or web content that the agent ingests.

Step‑by‑step guide explaining what this does and how to use it (for defensive hardening):

To protect your AI‑powered developer tools from similar native‑tool bypasses:

  1. Inventory all native tools: List every tool that your AI agent can invoke directly without going through your security evaluation layer. Focus on file‑system operations, shell commands, and network tools.
  2. Implement strict parameter validation: For each native tool, define an allowlist of permitted arguments and reject any input containing shell metacharacters, flags (like -X), or command separators (;, &&, |).
  3. Use a blocklist for dangerous file patterns: In Antigravity, the fix was to block `tasks.json` alongside .git. Identify and block file names or extensions that could be used to stage malicious scripts.
  4. Isolate agent execution: Run AI agents in isolated containers or virtual machines with minimal network access. Even if Secure Mode is bypassed, the blast radius should be limited.
  5. Log and monitor native tool usage: Enable detailed logging for all native tool invocations. Alert on unusual patterns—for example, `find_by_name` calls with `-X` flag or searches for sensitive file paths.

Python snippet to validate `find_by_name` arguments (defensive):

import re

def validate_find_by_name(pattern: str) -> bool:
 Block shell metacharacters and dangerous flags
dangerous_patterns = [r'-X', r'-exec', r';', r'&&', r'|', r'`', r'\$']
for pat in dangerous_patterns:
if re.search(pat, pattern):
return False
 Block known dangerous file names
blocked_files = ['.git', 'tasks.json', 'package.json', 'Dockerfile']
for blocked in blocked_files:
if blocked in pattern:
return False
return True

3. Credential Exfiltration and Supply Chain Risks

The attack demonstrated two distinct credential‑exfiltration paths. In the first path, the attacker extracted the `GITHUB_TOKEN` from the GitHub Actions runner. This token had `pull-requests: write` and `issues: write` permissions, enabling the attacker to tamper with PR comments and create the illusion of human approval.

In the second path, the privileged job also held a Google Cloud service‑account credential and an API key. The attacker could exfiltrate these to pivot from the AI agent’s execution context into the consumer project. Pillar Security demonstrated that the researcher‑controlled proof‑of‑concept attacks could achieve arbitrary code execution on the CI runner.

Step‑by‑step guide explaining what this does and how to use it (for defensive credential management):

  1. Apply the principle of least privilege to tokens: The `GITHUB_TOKEN` in the Google case had write access to issues, repository contents, and pull requests. Scope tokens to the minimum required permissions. For a triage agent, `issues: read` and `pull-requests: read` should suffice.
  2. Use short‑lived credentials: Avoid long‑lived personal access tokens (PATs) for automation. Use GitHub’s built‑in `GITHUB_TOKEN` with fine‑grained permissions, and rotate service‑account keys frequently.
  3. Separate bot identities: Do not use the same bot account for both low‑privilege and high‑privilege workflows. Each agent should have its own identity with narrowly scoped permissions.
  4. Implement human approval gates: Require manual review and approval for any workflow that can modify code, merge PRs, or access sensitive credentials. Automated bot reviews should never be the sole approval.
  5. Audit GitHub Actions permissions: Run `gh api /repos/{owner}/{repo}/actions/permissions` to check current permission settings. Review each workflow’s `permissions` block to ensure it is not overly permissive.

Linux command to check repository permissions (requires `gh` CLI):

gh api /repos/google/adk-python/actions/permissions

4. Google’s Response and Bug Bounty Controversy

Google responded by deleting three affected workflows from the ADK repository: issue-analyze.yml, issue-fix.yml, and pr-analyze.yml. The fixes were implemented by late July 2026. Pillar Security confirmed on July 2 that the workflows were absent, and Google confirmed the issue was fixed on July 21.

However, Google classified the vulnerability as ineligible for a bug‑bounty payment. The company argued that the exploit required social engineering—the attacker needed a maintainer to ultimately merge the malicious PR. Google stated that the exposed token had `pull-requests: write` permission, allowing tampering but not an immediate, automatic supply‑chain compromise.

This decision sparked debate in the security community. Researchers argued that if Google had given a bot identity to the initial triaging agent, most of the attack could have been prevented. The controversy underscores a broader challenge: as AI agents become more autonomous, traditional bug‑bounty criteria may need to evolve to account for multi‑step, agent‑mediated attack chains.

Step‑by‑step guide explaining what this does and how to use it (for patch management):

  1. Verify your ADK version: If you are using Google ADK for Python, check your version with pip show google-adk. Vulnerable versions are 1.7.0 through 1.28.0 and 2.0.0a1.
  2. Upgrade to patched versions: Update to version 1.28.1 or 2.0.0a2 (or later). Run pip install --upgrade google-adk>=1.28.1.
  3. Redeploy production instances: If you are running ADK Web locally or on Cloud Run/GKE, redeploy to the patched version.
  4. Review your GitHub Actions workflows: Even if you are not using ADK, audit your workflows for similar agent‑to‑agent trust relationships. Remove any workflows that can be triggered by untrusted comments.
  5. Enable branch protection rules: Require at least one human approval before merging PRs. Do not rely solely on bot reviews.

Windows PowerShell command to check ADK version:

pip show google-adk | Select-String "Version"

5. Architectural Lessons for Agentic AI Security

The Google ADK vulnerability reveals fundamental weaknesses in how we architect AI‑agent systems today. The triage agent and privileged agent shared an implicit trust relationship—the privileged workflow trusted any comment from a Collaborator‑level account, regardless of whether that account was under human or AI control.

Security teams must now treat each AI agent as a separate principal with its own identity, narrowly scoped permissions, and explicit limits on which agents and resources it can contact. Prompt‑injection defenses alone are insufficient if a low‑privilege agent can cause a privileged workflow to run. Organizations should implement “agent‑to‑agent” access control lists (ACLs) that define explicit communication channels between agents, rather than relying on human‑oriented permission models.

Step‑by‑step guide explaining what this does and how to use it (for architectural hardening):

  1. Define agent identities: Assign each AI agent a unique identity (service account, bot account, or workload identity). Do not reuse human accounts for automation.
  2. Implement agent‑to‑agent ACLs: Create a policy that explicitly lists which agents can invoke which other agents. Use attribute‑based access control (ABAC) to restrict based on agent type, environment, and sensitivity.
  3. Isolate credentials by agent: Never share credentials between agents. Each agent should have its own set of tokens, scoped to the minimum required permissions.
  4. Add human review gates: For any action that crosses a privilege boundary (e.g., low‑privilege triage agent invoking high‑privilege code‑fix agent), require explicit human approval.
  5. Monitor agent behavior: Implement anomaly detection for agent actions. Flag unusual patterns—for example, a triage agent suddenly posting commands intended for privileged workflows.

What Undercode Say:

  • Key Takeaway 1: The Google ADK vulnerability is the first documented real‑world case of agent‑to‑agent exploitation. It proves that AI agents can become attack bridges across permission boundaries when trust is implicitly shared rather than explicitly enforced.

  • Key Takeaway 2: Traditional security controls—sandboxes, command allowlists, and human‑centric permission models—are insufficient for agentic AI systems. Native tools that bypass evaluation layers, shared bot identities, and over‑permissive tokens create a perfect storm for multi‑stage attacks.

The attack chain demonstrates that the cybersecurity industry must move beyond sanitization‑based controls. Every native tool parameter that reaches a shell command is a potential injection point. Auditing for this class of vulnerability is no longer optional—it is a prerequisite for shipping agentic features safely. Organizations must treat each agent as a distinct principal, with its own identity, narrowly scoped permissions, and explicit communication channels. Human review gates must be preserved for actions that cross privilege boundaries, and credentials must be short‑lived and minimally scoped.

The controversy over Google’s bug‑bounty decision highlights a growing tension: as attacks become more sophisticated and multi‑step, traditional vulnerability‑reward criteria may lag behind reality. Security researchers and platform owners must collaborate to define new reward structures that account for agent‑mediated, social‑engineering‑assisted attack chains. The era of autonomous agents operating at machine speed demands a new security paradigm—one where AI governs and secures AI, and where friend and foe are distinguished across millions of interactions that no human alone can track.

Prediction:

  • +1 The Google ADK disclosure will accelerate the development of agent‑specific security frameworks, including OWASP’s AI security guidelines and NIST’s AI risk management framework. Expect new standards for agent identity, credential management, and cross‑agent ACLs within 12–18 months.

  • -1 The bug‑bounty controversy may discourage researchers from reporting complex, multi‑step agent‑mediated vulnerabilities, potentially leaving similar flaws undisclosed. This could lead to an increase in undiscovered “agent‑to‑agent” vulnerabilities across major AI platforms.

  • -1 As AI agents become more autonomous and are granted broader permissions, the attack surface will expand exponentially. Without fundamental architectural changes—such as agent‑specific identities and explicit trust boundaries—the industry will see a surge in supply‑chain attacks leveraging AI agents as unwitting vectors.

▶️ Related Video (80% Match):

https://www.youtube.com/watch?v=9QdbMFkPh74

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/erMJiSae – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: