First Blood: Google's ADK Incident Unveils a New Frontier in AI Security

The world of artificial intelligence just got a stark reminder that as AI systems become more autonomous and complex, so do their vulnerabilities. In a development that sounds straight out of a sci-fi thriller, security researchers at Pillar Security have disclosed what they're calling the "first-ever real-world agent-to-agent exploitation method." This groundbreaking vulnerability, found in Google's popular Agent Development Kit (ADK) for Python, demonstrates how one AI agent can be manipulated to control another, more privileged agent, opening up alarming new attack vectors.

The Digital Coup: When Agents Turn on Each Other

The incident centers around google/adk-python, an open-source toolkit with over 90 million downloads used to build and deploy AI agents. Pillar Security researchers, led by Dan Lisichkin, uncovered a critical flaw stemming from how two classes of automated AI agents, operating with different privilege levels, unintentionally shared a trust boundary.

Here's a breakdown of how the "digital coup" unfolded in two distinct attack paths:

Path 1: Poisoned Pull Requests and Fabricated Approvals

Initially, researchers discovered that a low-privilege, public-facing AI agent, activated by user pull requests (PRs) or issues, could be manipulated via prompt injection. This agent was operating with collaborator privileges. By crafting specific prompts, an attacker could trick this public agent into triggering a high-privilege, maintainer-only agent.

The attack involved:

1. An attacker creating a malicious PR (PR A) with poisoned code.
2. The public-facing agent reading the PR text and marking it for review.
3. The attacker then opening a second PR (PR B) with a prompt injection, specifically an @gemini-cli handoff.
4. This handoff, trusted by the high-privilege agent, triggered its workflow, leading to the execution of malicious actions. This allowed the attacker to modify comments, dismiss reviews, and even post "approvals" as the bot, creating a completely fabricated trail suggesting human and bot review. While this path still required a human maintainer to ultimately merge the malicious PR, the automated manipulation could significantly influence their decision.

Path 2: Remote Code Execution and Secret Exfiltration

Shortly after the first discovery, Pillar found an even more severe vulnerability in newer workflows using an Antigravity-based agent. Here, a prompt injection in a public issue could induce an analysis agent to post the command /adk-issue-fix as adk-bot. Because adk-bot was a "collaborator," this cleared the privileged agent's trigger check, allowing it to run.

This second path enabled remote code execution without maintainer interaction. Researchers successfully demonstrated extracting the adk-bot's GitHub personal access token (PAT) and even a Google Cloud service account key to an attacker-controlled server.

Google's Response and the Bug Bounty Debate

Google swiftly addressed the underlying issues in the ADK repository, hardening its defenses. However, they deemed the first exploit non-rewardable in their bug bounty program, citing that it required social engineering for the final merge. While they provided credit for the report, the decision sparked debate about the evolving definition of "social engineering" in an agent-driven world.

Following the discovery of the second, more critical vulnerability, Google took decisive action, deleting three affected ADK workflows from the Python repository. This "stop-the-bleeding" move highlights the severity of the RCE and secret exfiltration risks.

The Future of AI Security: A New Threat Model

This incident is more than just another bug; it's a paradigm shift in cybersecurity. As Pillar's Dan Lisichkin noted, "New attack surfaces are not yet reflected in threat models because these attacks never could exist in the 'pre-agent' world."

Key takeaways for the AI-driven future:

• Natural Language as an Authorization Path: The core issue is that natural language, often ambiguous, has become a channel for authorization between systems.
• Beyond Isolation: Simple agent isolation isn't enough. Agents need their own distinct identities that explicitly define what resources they can access and how they can interact with them.
• Refined Threat Models: Security teams must urgently update their threat models to account for agent identity, inter-agent communication, and resource access.
• Robust Logging and Auditing: Changes to reviews, comments, and approval states, especially by automated agents, must be treated as security events and logged independently, beyond the reach of the compromised workflow.
• Human Approval Isn't a Panacea: Even with human oversight, manipulated evidence from compromised agents can still lead to disastrous decisions.

Conclusion

The Google ADK "agent-on-agent violence" incident is a crucial wake-up call. It marks the formal arrival of a new era in cybersecurity where AI systems aren't just targets, but active participants in the attack chain. As we increasingly rely on autonomous agents in critical workflows, understanding and securing these complex interactions will be paramount to preventing the next generation of digital warfare.