Google ADK for Python Repo Vulnerability: Agent-to-Agent Privilege Escalation Discovered

Post Views: 5

Researchers have identified a critical privilege escalation vulnerability within Google’s Agent Development Kit for Python (adk-python) repository on GitHub, according to findings disclosed by Pillar Security.

Overview of the Vulnerability

The flaw, termed an “agent-to-agent” exploit, allowed unauthorized access to sensitive credentials and potential manipulation of repository workflows. The vulnerability was addressed by Google on July 21, 2026, following coordinated disclosure.

First Vulnerability: GitHub Actions Workflow Exploitation

Pr-Triage.yml Workflow

The first vulnerability stemmed from a GitHub Actions workflow named pr-triage.yml, which utilized an AI agent called “adk_pr_triaging_agent” to automate interactions with pull requests (PRs). This agent operated under a user account labeled “adk-bot” with Collaborator-level privileges, rather than a restricted bot account.

Exploit Chain

Pillar Security researchers discovered that two additional workflows—gemini-invoke.yml and gemini-review.yml—were triggered when a Collaborator posted comments beginning with “@gemini-cli” or “@gemini-cli /review.” By crafting a PR with a prompt injection attack, the team manipulated the adk-bot account to invoke these workflows. This enabled the extraction of a GITHUB_TOKEN, which possessed “pull-requests: write” and “issues: write” permissions.

The exploit chain leveraged the GITHUB_TOKEN to alter comments on a malicious PR, creating the illusion of human approval for code changes. A secondary PR was designed to prompt adk-bot to initiate a code review process, bypassing standard verification steps.

Second Vulnerability: Antigravity SDK-Based Agent

Issue-Analyze.yml and Issue-Fix.yml Workflows

A second vulnerability involved an Antigravity SDK-based agent used in the issue-analyze.yml workflow, which automatically commented on select issues and PRs. A higher-privileged workflow, issue-fix.yml, was triggered when a Collaborator, Member, or Maintainer account issued the “/adk-issue-fix” command. This workflow engaged an Antigravity agent to generate code fixes.

Exploitation Method

Pillar Security demonstrated that an attacker could exploit the agent-to-agent prompt injection method to force adk-bot to invoke the issue-fix.yml workflow. This allowed execution of commands on the CI runner, exposing environment variables such as ADK_TRIAGE_AGENT, GOOGLE_API_KEY, and ADK_GCP_SA_KEY.

The latter was identified as a service account key for the adk-python GCP project, though its exact privileges remained unconfirmed.

Google’s Response and Recommendations

Google acknowledged that while the token allowed modifications to PRs, manual approval from a maintainer was still required to merge the code. The tech giant stated it would not reward reports involving social engineering but confirmed the repository had been hardened against such attacks.

Pillar Security emphasized that agentic workflows, which process untrusted inputs, pose significant risks if tied to human accounts or long-lived tokens with broad access. The researchers advised organizations to assign agents distinct, narrowly scoped identities and implement safeguards against cross-privilege boundary interactions. They also highlighted the importance of auditing agent behaviors to prevent prompt injection attacks from forging triggers.

Conclusion

Google’s response to the findings included immediate patching of both vulnerabilities and a commitment to enhancing repository security measures. The incident underscores the growing complexity of securing AI-driven workflows and the need for proactive mitigation strategies in software development ecosystems.