Listen to this Post
Introduction:
In what security researchers are calling the first practical, real-world case of agent-to-agent exploitation, Pillar Security discovered a critical vulnerability in Google’s Agent Development Kit (ADK) for Python repository. The flaw exposed a dangerous trust boundary failure: a low-privilege, public-facing AI agent could be manipulated through prompt injection into triggering a high-privilege, maintainer-only agent with broad repository and cloud credentials. This incident fundamentally changes how security professionals must think about AI agents in CI/CD pipelines—natural language has officially joined the authorization path.
Learning Objectives & Secrets:
- Objective 1: Understand Agent-to-Agent Attack Vectors – Learn how prompt injection can turn one AI agent into a bridge to compromise another, more privileged agent, bypassing traditional identity and permission controls.
-
Objective 2 Secret Tip: Validate the Source, Not Just the Identity – The attack succeeded because the privileged workflow validated who posted a triggering comment, not whether the trusted account had been manipulated. Never assume that a comment from a trusted bot account is genuinely authorized.
-
Objective 3 Secret Tip: Treat Every Agent as a Separate Principal – Security teams should assign each agent its own narrowly scoped identity and explicit limits on which agents and resources it can contact. Prompt-injection defenses alone are insufficient.
You Should Know:
- The Attack Chain: From Public Issue to Privileged Workflow
The adk-python repository ran two tiers of automated AI agents. A low-privilege public-facing agent was triggered whenever any user opened a pull request (PR) or issue. A second, high-privilege agent was reserved for trusted maintainers. Pillar Security demonstrated that by crafting a PR comment disguised as a legitimate contribution, the public triage agent could be tricked into posting a comment starting with “@gemini-cli”—which triggered the privileged `gemini-invoke.yml` workflow.
Because the triage agent commented using a real collaborator account (adk-bot), GitHub treated the trigger as coming from a trusted human. The privileged workflow then executed commands on the CI runner with extensive permissions, including `pull-requests: write` and issues: write.
The researchers extracted the `GITHUB_TOKEN` and demonstrated that they could edit other users’ comments, impersonate maintainers, and fabricate an entire believable approval trail on a malicious PR—all without any human ever actually reviewing it.
Step-by-Step Guide to Understanding the Exploit:
- Create PR A (Legitimate-Looking) : Submit a pull request containing a real fix combined with malicious code (e.g., modified `package.json` or malicious dependency).
-
Create PR B (Trigger) : Submit a second pull request with prompt-injection instructions designed to manipulate the triage agent.
-
Trigger the Handoff: The public triage agent reads the attacker’s text and, due to prompt injection, posts an “@gemini-cli” comment as
adk-bot. -
Privileged Workflow Activation: GitHub treats the comment as coming from a collaborator, triggering the privileged `gemini-invoke.yml` workflow.
-
Token Exfiltration: The privileged workflow runs on the CI runner, where the attacker extracts the `GITHUB_TOKEN` and potentially Google Cloud service account credentials.
-
Approval Trail Fabrication: Using the extracted token, the attacker edits comments, submits approving reviews as
github-actions</code>, and removes legitimate review requests.</p></li> <li><p>Social Engineering: A maintainer is still required to merge the PR, but the fabricated approval trail makes the malicious code appear fully reviewed and ready.</p></li> <li><p>The Second Attack Path: Antigravity SDK Command Allowlist Bypass</p></li> </ol> <p>Google added new Antigravity SDK-based automation to the repository after the initial disclosure. This introduced a fresh vulnerability: a command allowlist meant to restrict the privileged agent to safe “git” and “gh” operations could be bypassed using Git’s own scripting features. The workflow `issue-fix.yml` listened for `/adk-issue-fix` comments and restricted execution to owners, members, or collaborators. The gate checked who posted the command, not whether an outsider had manipulated the trusted account. Pillar found that Git could still be used to launch arbitrary code through mechanisms like `core.hooksPath` and shell aliases. <h2 style="color: yellow;">Step-by-Step Guide to the Allowlist Bypass:</h2> <ol> <li>Open a Malicious GitHub Issue: No privileged access required—anyone can open an issue.</p></li> <li><p>Prompt Injection: Embed prompt-injection instructions in the issue text.</p></li> <li><p>Trigger Analysis Agent: The `issue-analyze.yml` workflow runs automatically, authenticates with <code>ADK_GCP_SA_KEY</code>, and posts an analysis as <code>adk-bot</code>.</p></li> <li><p>Invoke Fixing Workflow: The analysis agent posts <code>/adk-issue-fix</code>, which triggers <code>issue-fix.yml</code>.</p></li> <li><p>Bypass the Allowlist: The script rejects shell metacharacters but allows Git commands. Use Git’s `core.hooksPath` or shell aliases to execute arbitrary code.</p></li> <li><p>Exfiltrate Credentials: The runner holds a long-lived personal access token and Google Cloud service account credentials—both become accessible to the attacker.</p></li> </ol> <h2 style="color: yellow;">3. Permission Boundaries and Credential Exposure</h2> <p>The exposed credentials in this attack were alarming. The privileged job held: - A maintainer bot’s personal access token (PAT)—the credential actually exploited - A job-scoped `GITHUB_TOKEN` declared with write access to pull requests, issues, and repository contents - A Google Cloud service account key The PAT’s exact scopes were not public, but the workflow was designed to edit code, create an `adk-bot` fork, push a branch, and open pull requests. The researchers demonstrated that the `adk-bot` PAT could be extracted from the runner to an attacker-controlled server. <h2 style="color: yellow;">Linux Command to Check GitHub Token Permissions:</h2> [bash] Use GitHub CLI to check token permissions gh auth status gh api /user --header "Authorization: token YOUR_TOKEN" Check repository permissions gh api /repos/owner/repo/collaborators/username/permission
Windows Command (PowerShell) to Check Environment Variables for Secrets:
List all environment variables (useful for CI/CD secret discovery) Get-ChildItem Env: Check for common credential variables Get-ChildItem Env: | Where-Object { $_.Name -match "TOKEN|KEY|SECRET|PASSWORD" }4. Google’s Response and the Bug Bounty Controversy
Google deleted three AI agent workflows—
issue-analyze.yml,issue-fix.yml, andpr-analyze.yml—in a patch dated June 9, 2026. However, the company classified the exploit as non-rewardable for a bug bounty payment because it required social engineering—a maintainer still had to merge the malicious PR.Pillar Security researcher Dan Lisichkin pushed back on this characterization, arguing that “CISOs and security practitioners should start considering these scenarios, threat-modeling them, and calculating worst-case implications and blast radius”. Google did credit the researcher with an Honorable Mention but declined a financial payout.
5. Broader Implications for AI Agent Security
This vulnerability represents a structural weakness rather than a one-off bug. The underlying issue—one agent manipulating another across a trust boundary—will recur in any multi-agent system where:
- Agents ingest untrusted text (issues, PRs, emails, support tickets)
- Agents share credentials or trust relationships
- Privileged workflows validate identity rather than intentSanchit Vir Gogia, chief analyst at Greyhound Research, noted that “natural language has joined the authorization path”. An agent’s authority should be measured not only by its assigned tools but also by the more privileged systems its output can trigger or influence.
What Undercode Say:
- Key Takeaway 1: Agent-to-agent attacks are no longer theoretical. This is the first documented real-world exploitation of a production multi-agent system, and it changes how we must model threats in AI-powered CI/CD pipelines.
-
Key Takeaway 2: Traditional identity and permission controls are insufficient when agents can be manipulated through natural language. Organizations must treat each agent as a separate principal with its own identity, narrowly scoped permissions, and explicit limits on which agents and resources it can contact.
The Pillar Security disclosure reveals that the security industry has been slow to adapt to the unique risks of multi-agent systems. As Dan Lisichkin warned, “new attack surfaces are not yet reflected in threat models because these attacks never could exist in the first place in the ‘pre-agent’ world”. The attack required no sophisticated hacking—just knowledge of English to craft a prompt injection, or simply asking an AI to do it. This democratization of attack capability means that every organization deploying AI agents in automated workflows must urgently reassess its security posture. The ADK vulnerability is not an isolated incident; it follows Pillar’s earlier discovery of a CVSS 10.0 vulnerability in Google’s `gemini-cli` that allowed a single malicious GitHub issue to exfiltrate CI credentials and achieve full supply-chain compromise. The pattern of trusted-input vulnerabilities in agentic systems is recurring, and it demands a fundamental rethinking of how we authorize actions in an AI-driven world.
Prediction:
- -1: The AI agent attack surface will grow exponentially as more organizations deploy multi-agent systems in CI/CD, customer support, and automated decision-making. Expect a wave of similar vulnerabilities in 2026-2027 as researchers probe trust boundaries that were never designed to withstand prompt-injection attacks.
-
-1: Bug bounty programs that exclude social-engineering-dependent exploits will create a dangerous blind spot. Attackers are not constrained by bug bounty rules, and the ADK case proves that a social-engineering element does not make an attack impractical—it simply requires more patience.
-
+1: This disclosure will accelerate the development of new security frameworks for agentic AI. Expect to see emerging standards for agent identity, permission scoping, and trust boundary enforcement in CI/CD pipelines within the next 12-18 months.
▶️ Related Video (82% Match):
https://www.youtube.com/watch?v=6mQwHqK1I5w
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by ThousandsIT/Security Reporter URL:
Reported By: https://lnkd.in/p/ehpVf4t6 - Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeTesting & Stay Tuned:
