Google ADK security flaws impact AI agent workflows

Security vulnerabilities discovered in the GitHub repository for the Google Agent Development Kit for Python show how public AI agents can trigger unauthorized, high-privilege automation. These flaws allowed external contributors to manipulate code reviews and expose sensitive credentials. Google corrected the issues after researchers from Pillar Security reported the potential for exploitation.

Exploitation paths in automated repositories

The primary risk involved a triage agent designed to evaluate pull requests from outside contributors. This agent functioned using a specific account that held collaborator status within the repository. Researchers found that a malicious actor could embed specific instructions within a pull request to trick the agent. This trickery forced the agent to issue commands that activated workflows normally reserved for trusted internal users.

Once these workflows were active, they allowed for the execution of commands within the continuous integration environment. Although the associated tokens could not directly push code, they possessed the power to modify issues and pull requests. An attacker could use these permissions to change comments made by maintainers or submit fake approvals. This activity created a situation where a dangerous pull request appeared legitimate and ready for final merging.

Pillar Security successfully demonstrated this attack chain within a controlled research setting. While a human maintainer still had to finalize the merge process, the automated deception made the malicious code look safe. Google responded to these findings by strengthening the security settings of the repository to prevent such unauthorized command triggers.

A second attack method focused on newer workflows using a different type of agent. In this scenario, an attacker could place a prompt injection inside a public issue. This injection induced an analysis agent to start a fixing workflow that should have been restricted to authorized personnel. Even though the system tried to limit the agent to standard version control commands, the researchers proved that these commands could still launch unauthorized code.

During the demonstration of the second flaw, researchers extracted a personal access token to an external server. They also found that a Google Cloud service account key was accessible during the workflow. Google confirmed the removal of the problematic workflows in early July and finalized fixes for the second issue later that month. These events serve as a reminder that automated systems often lack the context to distinguish between helpful requests and malicious injections.

Redefining authority in agentic systems

The findings represent a significant shift in how security professionals must view multi-agent environments. Experts suggest that the core issue is not just the existence of the flaws but the way authority is passed through natural language. When an agent acts on a message, that message becomes a part of the authorization chain. This change requires a new approach to managing permissions in complex automated systems.

Security analysts point out that an agent holds more power than its basic toolset suggests. Its true authority includes any higher-level systems that its output can influence or activate. If a low-level agent can talk to a high-level agent, the security boundary between them is often thinner than expected. Organizations must reconsider how they grant access to agents that interact with untrusted data from the public.

Determining the severity of these risks requires a detailed look at how agents consume content. Security leaders need to identify which agents handle external inputs like emails, support tickets, or pull requests. They must then trace whether the output from those agents can trigger more powerful workflows. Understanding the maximum capability of every identity and tool in the chain is essential for preventing unauthorized access.

The complexity of these systems means that standard security tools often provide only a partial picture. Typical identity management or application security software might see individual pieces but miss the entire delegation path. A single event can trigger a series of actions across multiple agents, creating a hidden path of authority. Mapping these connections is the only way to see what can actually happen during a breach.

Following the path of external data is a critical task for modern security teams. They must track information from the moment it enters the system until a downstream action occurs. This includes looking at shared states, such as comments on a platform, which might serve as a trigger for another process. The fundamental question for defenders is whether a less privileged agent can change something that a more privileged agent trusts.

Securing the human in the loop

Human oversight is often considered a final safeguard against automation errors, but it is not a perfect solution. In the case of the Google repository, a person still had to click the merge button. However, the manipulated AI agents provided the human with false evidence. When the system shows that code has been approved and verified by other bots, a human is much more likely to trust the result.

An attacker does not need the right to merge code if they can trick a person into doing it for them. This is why experts suggest that approvals must be tied to a specific, unchangeable version of the code. If the code changes even slightly after an inspection, any previous approval should become void. This ensures that the artifact a human sees is exactly what gets deployed into the production environment.

Beyond tightening the approval process, organizations should treat changes to reviews and comments as significant security events. These actions should be recorded in an independent logging system. It is vital that the identity used by the automated workflow cannot modify these logs. This creates a permanent, tamper-proof record of how decisions were made and who, or what, influenced them.

The transition to using natural language as a tool for automation brings both efficiency and new types of danger. These flaws in the Google ADK demonstrate that trust is a major vulnerability in AI development. Developers must build systems that verify the source and intent of every message before allowing it to influence a higher-level process. Without these safeguards, the speed of AI automation will only lead to faster and more successful attacks.

As more companies adopt agent-based architectures, the lessons from this discovery will become increasingly important. Security is no longer just about protecting passwords and API keys. It is now about protecting the integrity of the conversation between different parts of a system. Monitoring the flow of information and maintaining strict boundaries between agents are the primary ways to defend against these emerging threats.