Affected Systems

Google Agent Development Kit (ADK) Python repository on GitHub. Three workflows removed: issue-analyze.yml, issue-fix.yml, and pr-analyze.yml. Affected repository automation infrastructure, not the distributed ADK Python package itself. Exposure window: until June 9, 2026 patch.

Exploitation Status

Proof-of-concept demonstrated by Pillar Security showing arbitrary code execution on CI runners and exfiltration of bot personal access token, Google API key, and Google Cloud service account credentials. No evidence of in-the-wild exploitation or compromised ADK releases identified.

Business Impact

Attackers could manipulate public GitHub issues to trigger privileged AI agent workflows through prompt injection. The triage agent could be coerced into posting commands as adk-bot (a repository collaborator), bypassing authorization checks. Successful exploitation enabled arbitrary code execution on GitHub Actions runners and credential theft (bot PAT with undisclosed scopes, Google API keys, GCP service account with at least Vertex AI access). Repository automation was vulnerable; the distributed Python package was not affected. No downstream supply chain compromise confirmed.

Urgency

🟡 Within a week

Recommended Actions

  • Audit GitHub Actions workflows that process untrusted input (issues, PRs, comments) and authenticate AI agents or bots with elevated repository or cloud permissions
  • Implement separate bot identities for triage vs. privileged operations; ensure authorization checks validate the original human actor, not intermediate bot accounts
  • Scope GitHub personal access tokens and service account credentials to minimum required permissions; document and review token scopes for all automation bots
  • Disable or restrict AI agent tool capabilities (e.g., Google Antigravity CapabilitiesConfig) in CI/CD contexts; prevent file writes that could enable Git hook injection or similar code execution paths
  • Monitor for prompt injection patterns in public issue trackers that attempt to invoke privileged commands or manipulate bot behavior; consider input validation or sandboxing for AI-driven automation

---

# Threat Actor Context

Actor Profile

Pillar Security is a cybersecurity research firm that discovered and responsibly disclosed a prompt injection vulnerability in Google's Agent Development Kit (ADK) Python repository. The research was conducted as a security assessment of AI agent workflows, not as a malicious threat actor. The team demonstrated proof-of-concept attacks showing arbitrary code execution on CI runners and credential exfiltration, but explicitly noted no evidence of in-the-wild exploitation or compromised ADK releases. Their motivation was to identify and remediate security flaws in AI agent authorization patterns before adversaries could exploit them.

TTPs (Tactics, Techniques, Procedures)

The attack chain leveraged prompt injection (MITRE ATT&CK T1059 - Command and Scripting Interpreter) to manipulate a public-facing triage agent into invoking a privileged code-fixing agent. The technique exploited weak authorization controls where the system validated the identity of the comment poster (adk-bot, a trusted collaborator) but not whether an external actor had manipulated that account. The researchers achieved arbitrary code execution (T1203 - Exploitation for Client Execution) on the CI runner by writing malicious payloads and using Git's core.hooksPath to redirect execution to attacker-controlled hooks. Credential access (T1552.001 - Unsecured Credentials: Credentials In Files) was demonstrated through exfiltration of the bot's personal access token (PAT), a Google API key, and Google Cloud service-account credentials from the CI environment. The privileged workflow had write access to repository contents, issues, and pull requests, enabling potential supply chain compromise.

Targets & Patterns

The vulnerability affected Google's internal development infrastructure, specifically the ADK Python repository's automation workflows. The exposed credentials had potential reach into Google Cloud Platform (Vertex AI access in a dedicated GitHub-management project) and GitHub repository management. While the immediate impact was contained to repository automation rather than the distributed ADK package itself, the attack pattern represents a broader risk to organizations deploying AI agents with elevated privileges in CI/CD pipelines. Software development teams using similar AI-assisted workflows with shared bot identities and broad token scopes are at risk. The research highlights systemic vulnerabilities in AI agent authorization models where prompt injection can bridge trust boundaries, particularly affecting cloud services and software development sectors that increasingly integrate autonomous AI agents into their development workflows.

Historical Context

This disclosure is part of an emerging pattern of AI agent security vulnerabilities identified in 2026. The article references multiple contemporaneous incidents: Android AI agents allowing invisible screen text to execute code on host PCs, Azure DevOps MCP flaws enabling hidden PR comments to hijack AI review agents, Claude Cowork vulnerabilities allowing AI agent VM escape, ChatGPT AgentForger flaws deploying rogue workspace agents, and the Hermes AI agent being run unattended for post-exploitation at Thailand's Finance Ministry. The Google ADK case represents one of the first documented instances of prompt injection being weaponized to bypass authorization controls in a major vendor's AI development tooling. Google's June 9, 2026 removal of the vulnerable workflows (verified by Pillar on July 2 and confirmed fixed July 21) demonstrates rapid remediation following responsible disclosure. The vulnerability was in repository automation infrastructure, not the ADK package itself, distinguishing it from traditional software supply chain compromises.

Defensive Recommendations

  • Implement separate bot identities for public-facing and privileged AI agent workflows to prevent authorization bridging through compromised or manipulated trusted accounts
  • Apply principle of least privilege to bot personal access tokens (PATs) and service account credentials, narrowing scopes to only required operations and avoiding broad repository write access
  • Validate authorization signals using cryptographic or out-of-band mechanisms that untrusted text input cannot generate through prompt injection, rather than relying solely on comment author identity
  • Disable or explicitly allowlist AI agent tool capabilities rather than using CapabilitiesConfig() with all tools enabled; restrict file write operations and Git hook path manipulation in CI/CD environments (mitigates T1059)
  • Monitor CI/CD runner environments for credential exfiltration attempts (T1552.001) by detecting unusual network connections, environment variable access patterns, and Git configuration changes to core.hooksPath