A Critical Vulnerability in Google’s Agent Development Kit Exposes Secrets and Enables Pull Request Tampering
Google’s Agent Development Kit (ADK) for Python, a widely used framework for building automated AI agents, has been found to be vulnerable to a critical attack method. A security researcher from Pillar Security discovered that an attacker could manipulate the ADK’s public-facing agent to gain access to restricted capabilities, including command execution, and potentially compromise the entire supply chain. The vulnerability, which was reported in early June, has since been fixed by Google.
The ADK is designed to provide a secure way for developers to build automated agents that can interact with their repositories on GitHub. However, Pillar’s researcher Dan Lisichkin found that an attacker could manipulate the low-privileged, public-facing agent to pass prompts to the high-privileged one, which has access to restricted capabilities. This allowed the attacker to execute code remotely and potentially extract the agent’s GitHub token.
Lisichkin discovered that the ADK’s triager agent, responsible for reviewing pull requests, was commenting on PRs as a Collaborator, giving it high privileges on the repository. By manipulating this agent, Lisichkin was able to post comments containing prompts that would trigger the gemini-invoke workflow, which leaked sensitive information about the privileged agent’s capabilities.
The vulnerability allowed an attacker to perform various malicious actions, including modifying comments and PRs, dismissing reviews or approving changes, and invoking gemini-review against any PR. This also enabled the attacker to poison the PR approval lifecycle by manipulating the triager’s comment. However, it’s worth noting that the attack scenario requires social engineering to succeed, as a malicious PR would need to be approved and merged by a member.
Google addressed the issue through hardening, but initially did not consider it worthy of a bug bounty reward due to its requirement for social engineering. Shortly after, Pillar discovered another vulnerability in the ADK repository related to remote code execution without a maintainer’s interaction, which was fixed by Google in late July.
The discovery highlights the importance of secure coding practices and the need for continuous testing and monitoring of open-source software. It also underscores the risks associated with supply chain compromise and the potential consequences of vulnerable dependencies. Developers using the ADK should take this vulnerability as a reminder to regularly review their code, update dependencies, and implement robust security measures.
To mitigate similar vulnerabilities in the future, developers should prioritize secure coding practices, use automated testing tools, and continuously monitor their software for updates and patches. Additionally, users of open-source software should remain vigilant and report any suspicious activity or vulnerabilities they may encounter. By taking these steps, we can reduce the risk of supply chain compromise and ensure a more secure online environment.
Source: SecurityWeek — 2026-08-04