Google’s publicly available AI agent development framework, the Agent Development Kit (ADK), has been found to contain a serious security flaw in its repository operations. Security firm Pillar Security demonstrated that by exploiting malicious issues on the public repository, an attacker could hack a lower-privileged agent and execute code with elevated permissions. Google has acknowledged the problem and completed remediation by removing the affected workflows.

Pillar Security researchers developed an attack technique that involved filing an issue containing a specific prompt against Google’s public Python repository for ADK. In this attack, the triage agent is first manipulated into posting a specific comment based on the malicious prompt rather than human instructions. As a proof of concept, the researchers created an issue instructing the agent to output the text “Marker: POC-MARKER-verify-1779978519” and confirmed that the agent indeed posted that exact phrase in its comment.

More critically, the agent was treated as a “collaborator” on GitHub rather than a “bot.” This misclassification served as a bridge to invoke “maintainer-only workflows,” which are typically reserved for human maintainers. By carefully crafting malicious prompts in line with Google’s official contribution guidelines, the researchers successfully triggered a privileged code-fixing agent from the lower-privileged agent, allowing them to impersonate a “maintainer with the authority to reject or approve pull requests.”

The attack chain stemmed from the repository’s workflow definitions. The “issue-analyze.yml” workflow, which runs automatically when an issue is opened, authenticated using a Google Cloud service account key (ADK_GCP_SA_KEY) and provided the triage agent (ADK_TRIAGE_AGENT) and a Google API key (GOOGLE_API_KEY) to Google’s coding agent, Antigravity. Meanwhile, another workflow, “issue-fix.yml,” monitored for the specific comment “/adk-issue-fix” and was designed to execute only if the user who posted the comment was a repository owner, member, or collaborator.

This authentication gate only checked the superficial information of who posted the command and failed to account for the possibility that a trusted account could be manipulated by an external attacker. When the researchers tricked the triage agent into posting “/adk-issue-fix” as “adk-bot,” the comment satisfied the privileged workflow’s authentication conditions, effectively granting the attackers a privileged code execution environment.

The researchers exploited this privileged job to achieve arbitrary code execution on CI (continuous integration) runners and exfiltrate the bot’s personal access token (PAT). Furthermore, the privileged job’s environment also contained the Google API key and Google Cloud service account credentials. According to Pillar Security’s report, Google confirmed that this service account had access to Vertex AI within a dedicated GitHub management project, though other permissions were not disclosed.

However, Pillar Security clarified that the proof-of-concept was conducted in a researcher-controlled environment, and no evidence was found of exploitation in real-world attacks or tampering with the distributed ADK Python package itself. The core issue lay not in the distributed ADK software, but in Google’s own repository automation configuration.

The researchers also discovered an additional attack vector that could create fake review traces through a privileged Gemini workflow, though the impact was limited as final pull request merges still required maintainer approval.

In response, Google removed the three affected workflows — “issue-analyze.yml,” “issue-fix.yml,” and “pr-analyze.yml” — from the repository in a patch dated June 9, 2026. Pillar Security confirmed the workflows had been removed on July 2, and Google responded on July 21 that the fix was complete. As of August 4, when The Hacker News verified, these files were no longer present in the repository’s main branch.

Pillar Security recommends the following measures for developers operating similar repositories:

Use separate, isolated identities for bots
Configure narrower permission scopes for tokens and tools
Use authentication signals that cannot be generated from untrusted text

The company noted: “This finding demonstrates that new attack surfaces are not being reflected in threat models. Security teams need to consider agent-based attack scenarios when building threat models to assess the potential impact.”

As AI agents expand into development processes such as code review and automated fixes, the new risk of agents themselves becoming attack vectors has come into sharp focus. This case underscores the need to treat the privilege design and trust boundaries of AI systems with the same rigor as traditional security measures when deploying them.