Pillar Security discovered an agent-to-agent attack method in Google’s Agent Development Kit for Python that could lead to secret exposure and pull request (PR) poisoning.
The google/adk-python repository had two classes of automated AI agents, namely low-privileged ones open to user interaction, and high-privileged ones accessible only to maintainers.
An attacker could manipulate the low-privileged, public-facing agent to pass a prompt to the high-privileged one, gaining access to restricted capabilities, including command execution, and potentially opening the door to supply chain compromise, Pillar’s Dan Lisichkin explains.
Initially, the company discovered that an agent responsible for triaging pull requests was commenting on PRs as a Collaborator, meaning it has high privileges on the repository.
Next, Lisichkin found a way to manipulate the agent into posting an @gemini-cli <prompt> as a comment on a PR, which triggered gemini-invoke and provided access to a more privileged workflow.
The initial prompt triggered a response from the gemini_invoke.yml workflow that leaked the tools the privileged agent had access to via the MCP server.
This revealed that the bot had access to every bash command, meaning that the researcher could execute code remotely and potentially extract the agent’s GitHub token.
According to Lisichkin, this allowed him to modify the comments, PRs, and issues of other maintainers, collaborators, and members; dismiss reviews or approve PR changes; and invoke gemini-invoke and gemini-review against any PR.
This also enabled the researcher to poison the PR approval lifecycle, but any malicious PR would have to be approved and merged by a member, which required social engineering.
The attack scenario would require a threat actor to build trust as a collaborator, then open a PR containing malicious code, which would be marked for review. The threat actor could then open a second PR containing prompts that would instruct the agent to mark the first PR as triaged, reviewed, and approved.
“Editing the triager’s comment uses the impersonation primitive from issues: write; posting and approving as the bot uses the RCE-extracted GITHUB_TOKEN; the label and review-request changes fall under pull-requests: write. Strung together, they manufacture a complete, believable ‘a human asked for a review, Gemini ran it, Gemini approved’ trail on the poisoned PR, none of which ever happened,” Lisichkin notes.
Google was notified of the finding in early June and addressed the issue through hardening, but did not consider it to meet the bar for a bug bounty reward, as it required social engineering to merge the malicious PR.
Shortly after, Pillar discovered another vulnerability in the ADK repository, in the automation features of the Antigravity-SDK-based agent, which could lead to remote code execution without a maintainer’s interaction. Google fixed the weakness in late July.
Related: Decades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks
Related: Ruby on Rails Patches Critical Vulnerability
Related: Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace
Related: Critical Code Execution Vulnerability Patched in TeamCity
