New Attack Vector Emerges as Researchers Uncover Flaws in Google’s Agent Development Kit for Python
A novel attack vector has been discovered by researchers at Pillar Security, who found a series of flaws in Google’s open-source Agent Development Kit (ADK) for Python. The vulnerabilities, which have since been patched by Google, allowed malicious agents to trigger automation that could compromise the software supply chain. This attack vector exploits a trust boundary between two AI agents with different privilege levels, demonstrating the emerging threat of agent-to-agent exploitation in multi-agent systems.
The flaws were discovered in the adk-python repository, which has been downloaded over 90 million times and is widely used by developers working with Gemini, Google’s large language model. The researchers showed that a low-privileged, public-facing AI agent reviewing pull requests could be manipulated into triggering a maintainer-only AI agent capable of performing privileged actions. This created a pathway for malicious code to be approved or executed in continuous integration (CI)/continuous delivery (CD) workflows, affecting the development process and potentially compromising the software supply chain.
The attack relies on prompt injections embedded in GitHub pull requests, which can manipulate the behavior of one AI agent to trigger commands that would normally require higher privilege levels. In a proof-of-concept exploit, the researchers demonstrated how this could be used to approve or execute malicious code. The finding highlights the new security consideration for enterprises when developing AI agent behavior: governing each agent independently is not enough; organizations must also understand what one agent can cause another agent to do.
The discovery of these flaws comes as a warning to security teams, who are only just beginning to grasp the implications of using AI agents in software development. “Enterprises are starting to put multiple AI agents into software delivery with different tools, permissions, and levels of authority,” says Ryan McCurdy, vice president of marketing at database governance firm Liquibase. “This research shows why governing each agent independently isn’t enough. Organizations also have to understand what one agent can cause another agent to do.”
The bigger takeaway from this discovery is that AI agents are changing some of the assumptions security teams have relied on when securing software development processes. As organizations continue to adopt AI and machine learning technologies, they must prioritize understanding the interactions between different AI agents and develop strategies for governing their behavior.
For developers using Google’s ADK for Python, it’s essential to understand the implications of this discovery and take steps to secure their AI agents and workflows. This includes implementing robust governance and monitoring mechanisms to detect and prevent agent-to-agent exploitation attempts. As we continue to navigate the emerging threat landscape of AI and machine learning, one thing is clear: securing AI agents will require a fundamentally different approach to security than what we’ve relied on in the past.
Source: Dark Reading — 2026-08-05