Researchers say Google's open-source Agent Development Kit for Python repository had a workflow flaw that could let an attacker use a poisoned pull request to manipulate one AI agent into invoking another with higher privileges. The issue affected the google/adk-python repository and relied on prompt injection in public pull requests plus trust relationships between a low-privilege triage agent and a maintainer-only agent using a collaborator personal access token; no CVE is cited, and Google says it has fixed the underlying problem.
Why it matters: Organizations experimenting with AI agents in code review and CI/CD should treat this as a real supply-chain risk, especially where public-facing agents can influence privileged workflows. Teams should review agent-to-agent trust boundaries, limit tokens and workflow permissions, and avoid letting untrusted repository content trigger high-privilege automation.
info@thehackernews.com (The Hacker News)
2026.08.04
96% relevant
This appears to cover the same underlying event and adds that Google deleted three vulnerable ADK GitHub workflows after researchers showed a malicious GitHub issue could trigger a more privileged agent through the repository's automation chain.
Ionut Arghire
2026.08.04
97% relevant
This article is a direct follow-up on the same Google ADK repository issue, adding detail on the agent-to-agent handoff path, the ability to leak available tools, achieve remote command execution via the privileged workflow, extract a GitHub token, and poison pull-request review and approval trails. It also notes a second Antigravity-SDK-based automation flaw that Google fixed in late July.
2026.08.03
100% relevant
This article establishes a distinct event: a specific prompt-injection and workflow-trust flaw in Google's Agent Development Kit repository that enabled agent-to-agent privilege escalation in open-source development workflows.
← Back to all stories