AI agents exploited in privilege escalation attack on Google's Agent Development Kit
Pillar Security researchers demonstrated how low-privilege AI agents in Google's Agent Development Kit for Python could be manipulated through prompt injection to trigger higher-privilege agents, potentially enabling pull request tampering and credential theft. Google removed the affected workflows and patched the issues after the July 2026 disclosure.
What happened
Pillar Security researchers discovered that low-privilege AI agents in Google's Agent Development Kit for Python could be weaponized to compromise higher-privilege agents through prompt injection attacks. A malicious pull request or public GitHub issue containing embedded instructions could induce a triage agent to post commands that triggered maintainer-level workflows intended only for trusted users.
In one attack path, instructions in a pull request caused the adk-bot agent to post an '@gemini-cli' command, triggering a workflow with write access to issues and pull requests. Researchers demonstrated that attackers could alter maintainer comments, submit approving reviews as github-actions[bot], and remove legitimate review requests. A second attack path involved injecting a prompt into a public issue to trigger an Antigravity-based fixing workflow, where Git commands could be exploited to launch arbitrary code and exfiltrate an adk-bot personal access token and Google Cloud service account key.
Reported impact
The researchers described these as the first practical real-world case of agent-to-agent exploitation in a production multi-agent system. The attacks could enable supply chain poisoning by submitting deceptive pull requests appearing to carry legitimate AI review approvals, potentially going undetected in fast-moving CI/CD pipelines.
The gemini-cli repository had logged over 90 million downloads at the time of disclosure.
Index analysis
The vulnerability exploited a trust hierarchy between agents at different privilege tiers. Low-privilege agents that accept public input were manipulated through prompt injection to invoke higher-privilege agents, allowing attackers to escalate their authority beyond what they could directly access.
Governance controls
Google hardened the repository in response to the initial findings. On July 2, the affected workflows were removed, and on July 21 Google confirmed the second issue had been fixed. Google declined to issue a bug bounty reward, citing the attack's reliance on social engineering as falling outside its bounty criteria.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.