Google Deletes AI Workflows After Prompt Injection Vulnerability Allowed Arbitrary Code Execution
Google removed three AI agent workflows from its ADK Python repository after researchers demonstrated how prompt injection could trigger a privileged code-fixing agent, leading to arbitrary code execution.
Google has taken down three AI agent workflows from its Agent Development Kit (ADK) Python repository following the discovery of a critical vulnerability that could allow for arbitrary code execution. Pillar Security researchers identified a flaw where a public GitHub issue could be manipulated through prompt injection to trigger a privileged code-fixing agent within the ADK.
The attack vector exploited the interaction between two automated workflows: issue-analyze.yml and issue-fix.yml. The issue-analyze.yml workflow, which ran automatically when an issue was opened, was designed to post an analysis using a bot account. The issue-fix.yml workflow, however, was restricted to owners, members, or collaborators, and listened for /adk-issue-fix commands. The vulnerability lay in the fact that the issue-fix.yml workflow checked the identity of the commenter, not whether that identity had been impersonated or manipulated.
Researchers demonstrated that an attacker could inject prompts into a public issue to make the adk-bot post the /adk-issue-fix command. Since adk-bot was a collaborator on the repository, this comment satisfied the authorization gate for the privileged issue-fix.yml workflow. This effectively allowed an unauthenticated external party to trigger a privileged operation using the trusted bot's identity as an authorization bridge.
Once triggered, the privileged job executed arbitrary code on the continuous integration (CI) runner. The researchers successfully demonstrated the exfiltration of the bot's personal access token (PAT), which also held a Google API key and a Google Cloud service-account credential. While the researchers confirmed arbitrary code execution and credential exfiltration, they did not identify any evidence of in-the-wild exploitation or a compromised ADK release.
The vulnerability was not in the distributed ADK Python package itself, but rather in the repository's automation workflows. Pillar Security has recommended several best practices for similar repositories, including the use of separate bot identities, limiting the scope of tokens and tools, and implementing authorization signals that cannot be generated by untrusted text inputs.
Google confirmed the issue and removed the affected workflows, specifically issue-analyze.yml, issue-fix.yml, and pr-analyze.yml, in a patch committed on June 9, 2026. Pillar Security verified the removal on July 2, and Google confirmed the fix on July 21. A subsequent check on August 4, 2026, confirmed that these workflows were no longer present in the repository's main branch.
This incident highlights the ongoing security challenges associated with AI-powered automation in software development. As AI agents become more integrated into development pipelines, ensuring their secure configuration and preventing prompt injection attacks remains a critical priority for organizations.