{"id":8980,"date":"2026-08-04T11:39:08","date_gmt":"2026-08-04T11:39:08","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=8980"},"modified":"2026-08-04T11:39:08","modified_gmt":"2026-08-04T11:39:08","slug":"google-adk-flaws-reveal-what-happens-when-ai-agents-trust-the-wrong-message","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=8980","title":{"rendered":"Google ADK flaws reveal what happens when AI agents trust the wrong message"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Security flaws in automated workflows in the GitHub repository for Google\u2019s Agent Development Kit for Python could allow public-facing AI agents<\/a> to trigger more privileged automation, opening one path to manipulate pull-request reviews and another to expose credentials, according to a report<\/a> from Pillar Security.<\/p>\n

The first attack path involved a triage agent that analyzed pull requests submitted by external contributors. The agent posted its responses through adk-bot, an account with collaborator access to the repository. Pillar found that malicious instructions embedded in a pull request could induce the agent to post an \u201c@gemini-cli\u201d command, triggering a workflow intended for trusted users.<\/p>\n

That workflow could enable command execution inside its CI runner. Its GitHub token could not push code, but it had write access to issues and pull requests. Pillar said those permissions could be used to alter a maintainer\u2019s comment, submit an approving review as github-actions[bot], and remove a legitimate review request, making a malicious pull request appear ready to merge.<\/p>\n

Pillar reproduced the first attack chain in its research environment. A maintainer still had to complete the merge, and the report said Google subsequently hardened the repository.<\/p>\n

The security firm also found a separate attack path in newer workflows built around an Antigravity-based agent. An attacker could place a prompt injection<\/a> in a public issue and induce an analysis agent to post the command that started a fixing workflow reserved for trusted repository users.<\/p>\n

The fixing workflow attempted to limit the agent to Git and GitHub commands, but Pillar found that Git could still be used to launch arbitrary code. The researchers demonstrated that the adk-bot personal access token could be extracted from the runner to an attacker-controlled server, while a Google Cloud service account key was also available to the workflow.<\/p>\n

Pillar said it confirmed on July 2 that the affected workflows had been removed and that Google told the researchers on July 21 that the second issue had been fixed.<\/p>\n

Agent handoffs expose risk<\/h2>\n

Pillar described the findings as the \u201cfirst practical, real-world case of agent-to-agent exploitation\u201d involving a production multi-agent system.<\/p>\n

Sanchit Vir Gogia<\/a>, chief analyst at Greyhound Research, said the underlying weaknesses were familiar, but their interaction required enterprises to reconsider how authority moves through agentic systems.<\/p>\n

\u201cNatural language has joined the authorization path,\u201d Gogia said. \u201cThat is the change worth reporting, not the \u2018first-ever\u2019 framing.\u201d<\/p>\n

Gogia said an agent\u2019s authority should be measured not only by its assigned tools, but also by the more privileged systems its output can trigger or influence.<\/p>\n

That broader reach should also shape how CISOs judge the severity of the risk, according to Sakshi Grover<\/a>, senior research manager for IDC Asia Pacific Cybersecurity Services.<\/p>\n

\u201cFor CISOs, materiality should be determined by tracing three things,\u201d said Grover. \u201cFirst, which agents consume untrusted content such as pull requests, issues, emails, support tickets, or external documents? Second, can the output of those agents directly or indirectly trigger another agent or workflow with higher privileges? Third, what is the maximum effective capability of the identities, credentials, and tools involved?\u201d<\/p>\n

Mapping transitive authority<\/h2>\n

Existing security tools may provide only a partial view of how authority moves between agents and workflows.<\/p>\n

Grover said IAM, PAM, CIEM, and application-security tools can expose individual identities, permissions, and unsafe workflow configurations, but may not recognize that those components form a single event-driven delegation path.<\/p>\n

\u201cInventory records what exists, while delegation mapping records what can happen,\u201d Gogia said.<\/p>\n

Gogia added that security teams should follow external input from the point it reaches an agent through to any downstream system that acts on the result. The review should also account for handoffs embedded in shared workflow state, such as a comment that triggers a command.<\/p>\n

\u201cThe harder question is not whether Agent A can call Agent B but whether Agent A can alter anything Agent B already trusts,\u201d he said.<\/p>\n

Human approval does not necessarily close that gap. Although the first attack path still required a maintainer to merge the pull request, the manipulated automation could influence the evidence presented to the maintainer.<\/p>\n

\u201cAn attacker needs no merge rights when it can manufacture the evidence that persuades someone else to merge,\u201d Gogia said. He added that approval should bind an independently authenticated reviewer to the exact code or artifact examined. Any material change should invalidate that approval.<\/p>\n

Grover added that changes to reviews, comments, and approval states should also be treated as security events and exported to an independent logging system that the workflow\u2019s own identity cannot alter.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Security flaws in automated workflows in the GitHub repository for Google\u2019s Agent Development Kit for Python could allow public-facing AI agents to trigger more privileged automation, opening one path to manipulate pull-request reviews and another to expose credentials, according to a report from Pillar Security. The first attack path involved a triage agent that analyzed […]<\/p>\n","protected":false},"author":0,"featured_media":8981,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-8980","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8980"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8980"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8980\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/8981"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}