A newly uncovered attack method, dubbed “Gemini Agent-to-Agent Attack,” has been found to exploit vulnerabilities in Google’s Agent Development Kit for Python, potentially leading to secret exposure and pull request poisoning. The discovery was made by Pillar Security, a cybersecurity firm that specializes in identifying and mitigating software vulnerabilities.
The issue lies in the way two classes of automated AI agents interact with each other within the ADK repository. One class is open to user interaction, while the other is accessible only to maintainers. An attacker could manipulate the public-facing agent to pass a prompt to the high-privileged one, gaining access to restricted capabilities such as command execution. This opens the door for supply chain compromise and potentially allows an attacker to extract sensitive information.
Dan Lisichkin, a researcher at Pillar Security, discovered that an agent responsible for triaging pull requests was commenting on PRs as a Collaborator, giving it high privileges on the repository. He then found a way to manipulate the agent into posting an @gemini-cli prompt as a comment on a PR, which triggered gemini-invoke and provided access to a more privileged workflow.
This allowed Lisichkin to extract tools available to the privileged agent via the MCP server, including every bash command. He could execute code remotely and potentially obtain the agent’s GitHub token. With this level of access, he could modify comments, PRs, and issues of other maintainers, collaborators, and members; dismiss reviews or approve PR changes; and invoke gemini-invoke and gemini-review against any PR.
While the attack scenario would require a threat actor to build trust as a collaborator and social engineer their way into getting malicious code approved and merged, the potential for damage is significant. The attacker could poison the PR approval lifecycle by manipulating the agent’s comments and approvals.
Google was notified of the finding in early June and addressed the issue through hardening. However, they did not consider it to meet the bar for a bug bounty reward, as it required social engineering to merge the malicious PR. Shortly after, Pillar discovered another vulnerability in the ADK repository, which could lead to remote code execution without a maintainer’s interaction.
The Gemini Agent-to-Agent Attack highlights the importance of secure coding practices and the need for organizations to regularly review and test their software for vulnerabilities. It also underscores the potential risks associated with AI-powered automation tools and the importance of implementing robust security measures to prevent supply chain compromise. As a practical takeaway, it’s essential for developers and maintainers to be aware of these types of attack vectors and take proactive steps to secure their codebases against similar threats.
Source: SecurityWeek — 2026-08-04