Google Dev Kit Vulnerability Enables First Agent-on-Agent AI Exploitation
Researchers discovered a supply-chain flaw in Google's Python Agent Development Kit, allowing a low-privilege AI agent to manipulate a higher-privilege one into executing malicious code.
Security researchers at Pillar Security have identified a novel exploitation method within Google's open-source Agent Development Kit for Python (google/adk-python), marking the first documented instance of one AI agent compromising another. The vulnerability, present in a toolkit downloaded over 90 million times, could enable attackers to compromise software supply chains by manipulating AI agents used in development workflows.
The exploit leverages the interaction between two classes of AI agents operating with different privilege levels within the development kit's repository. A low-privilege, public-facing agent, activated by user actions like pull requests (PRs) or issues, could be tricked via prompt injection. This manipulation could then trigger a second, high-privilege agent, typically reserved for maintainers, to execute malicious commands.
According to Pillar's Dan Lisichkin, who discovered and reported the flaw, the attack vector is particularly concerning because it highlights a new and evolving attack surface that may not yet be fully accounted for in existing security threat models. "Our world is changing quickly, and new attack surfaces are not yet reflected in threat models because these attacks never could exist in the first place in the ‘pre-agent’ world," Lisichkin stated.
The technical details reveal that an attacker would likely need to establish some level of trust within the repository by making legitimate contributions before attempting the prompt injection. Once trust is built, the attacker could create a PR containing both a genuine fix and malicious code. The public-facing agent, potentially using a collaborator's personal access token (PAT), would then process this PR, creating a seemingly legitimate trail for review.
Following the initial PR, the attacker would submit a second PR containing the prompt injection. This would trick the triage agent into invoking a privileged workflow, effectively executing the malicious payload. The exploit creates a convincing but false narrative that a human requested a review, an AI agent processed it, and the AI agent approved it, all without actual human intervention or legitimate AI approval.
Google has since patched the repository, but the company deemed the exploit non-rewardable under its bug bounty program, citing the need for social engineering and that the exploit only allowed tampering with a PR, not automatic merging. Despite this, Google acknowledged the report and stated they have "taken an action to harden the repository."
Lisichkin emphasized that the incident underscores the inadequacy of simple agent isolation. He advocates for distinct AI agent identities, each with clearly defined permissions and resource access controls. "Agents should have their own identity, which mandates what resources they are allowed to access and in what they are allowed to interact with these resources," he explained.
This discovery serves as a critical warning for CISOs and security practitioners. It highlights the urgent need to incorporate agent-on-agent exploitation scenarios into threat modeling exercises, assess potential blast radii, and develop robust defenses against these emerging AI-driven attack vectors within CI/CD pipelines and production environments.
Following the initial disclosure of the Google Agent Development Kit (adk-python) vulnerability, researchers uncovered a secondary flaw that bypasses command allowlists. This new vulnerability allows for remote code execution on the CI runner by exploiting git's scripting features, such as hooks and shell aliases. The exploitation chain could lead to the exfiltration of sensitive credentials, including Google Cloud service account tokens, by an attacker who only needs to open a GitHub issue.
This new report details that the vulnerabilities were specifically within Google's Python Agent-to-Agent communication protocol, allowing an attacker to exploit a trust boundary between AI agents with differing privilege levels. The flaws could have led to unauthorized automation and potential supply chain compromise, a scenario that Google has since patched.