Google Dev Kit Vulnerability Enables First Agent-on-Agent AI Exploitation
Researchers discovered a supply-chain flaw in Google's Python Agent Development Kit, allowing a low-privilege AI agent to manipulate a higher-privilege one into executing malicious code.
Security researchers at Pillar Security have identified a novel exploitation method within Google's open-source Agent Development Kit for Python (google/adk-python), marking the first documented instance of one AI agent compromising another. The vulnerability, present in a toolkit downloaded over 90 million times, could enable attackers to compromise software supply chains by manipulating AI agents used in development workflows.
The exploit leverages the interaction between two classes of AI agents operating with different privilege levels within the development kit's repository. A low-privilege, public-facing agent, activated by user actions like pull requests (PRs) or issues, could be tricked via prompt injection. This manipulation could then trigger a second, high-privilege agent, typically reserved for maintainers, to execute malicious commands.
According to Pillar's Dan Lisichkin, who discovered and reported the flaw, the attack vector is particularly concerning because it highlights a new and evolving attack surface that may not yet be fully accounted for in existing security threat models. "Our world is changing quickly, and new attack surfaces are not yet reflected in threat models because these attacks never could exist in the first place in the ‘pre-agent’ world," Lisichkin stated.
The technical details reveal that an attacker would likely need to establish some level of trust within the repository by making legitimate contributions before attempting the prompt injection. Once trust is built, the attacker could create a PR containing both a genuine fix and malicious code. The public-facing agent, potentially using a collaborator's personal access token (PAT), would then process this PR, creating a seemingly legitimate trail for review.
Following the initial PR, the attacker would submit a second PR containing the prompt injection. This would trick the triage agent into invoking a privileged workflow, effectively executing the malicious payload. The exploit creates a convincing but false narrative that a human requested a review, an AI agent processed it, and the AI agent approved it, all without actual human intervention or legitimate AI approval.
Google has since patched the repository, but the company deemed the exploit non-rewardable under its bug bounty program, citing the need for social engineering and that the exploit only allowed tampering with a PR, not automatic merging. Despite this, Google acknowledged the report and stated they have "taken an action to harden the repository."
Lisichkin emphasized that the incident underscores the inadequacy of simple agent isolation. He advocates for distinct AI agent identities, each with clearly defined permissions and resource access controls. "Agents should have their own identity, which mandates what resources they are allowed to access and in what they are allowed to interact with these resources," he explained.
This discovery serves as a critical warning for CISOs and security practitioners. It highlights the urgent need to incorporate agent-on-agent exploitation scenarios into threat modeling exercises, assess potential blast radii, and develop robust defenses against these emerging AI-driven attack vectors within CI/CD pipelines and production environments.