Google Gemini Agent Framework Vulnerable to Secret Exposure and PR Tampering
A security researcher demonstrated an attack against Google's Gemini agent framework, exposing secrets and enabling pull request tampering through a novel agent-to-agent exploit.
A security researcher has uncovered a critical vulnerability within Google's Agent Development Kit (ADK) for Python, which underpins the Gemini AI agent framework. The exploit allows a low-privilege agent to manipulate a more privileged agent, leading to the exposure of sensitive secrets and the potential tampering of pull requests (PRs) within the Gemini ecosystem.
Pillar Security's Dan Lisichkin detailed the attack, which targets the interaction between two classes of AI agents: publicly accessible, low-privilege agents, and restricted, high-privilege agents reserved for maintainers. By crafting a specific prompt to a public-facing agent, an attacker can trick it into passing a malicious instruction to a privileged agent.
This chain of commands allows the attacker to gain access to restricted capabilities, including arbitrary command execution. The initial exploit involved manipulating an agent responsible for triaging pull requests. By commenting on a PR with a specific command, the attacker could trigger a privileged workflow, revealing the tools the high-privilege agent had access to.
Lisichkin's investigation revealed that the privileged agent possessed the ability to execute any bash command. This granted the attacker the capability to perform remote code execution and, crucially, to potentially extract the agent's GitHub token. With this token, an attacker could then impersonate the privileged agent.
The implications of this access are far-reaching. The attacker could modify comments, PRs, and issues belonging to other repository members, dismiss reviews, approve PR changes, and even invoke other Gemini workflows against any PR. This effectively allows for the poisoning of the PR approval lifecycle.
While a malicious PR would still require a human maintainer's approval to be merged, the attack scenario involves building trust as a collaborator. The attacker would open a PR with malicious code, then use the compromised agent to mark it as triaged, reviewed, and approved, creating a deceptive trail of legitimate actions. This requires a degree of social engineering to trick a human into merging the compromised code.
Google was notified of the vulnerability in early June. While the company implemented hardening measures to address the issue, they did not deem it severe enough for a bug bounty reward, citing the social engineering requirement for a full compromise. Shortly after, Pillar Security discovered a separate, more severe vulnerability in the ADK repository's Antigravity-SDK-based agent, which allowed for remote code execution without human interaction. Google patched this second vulnerability in late July.
This discovery highlights the inherent risks in complex AI agent frameworks, particularly when agents with varying privilege levels interact. The potential for supply chain compromise through manipulated PRs and secret exposure underscores the need for robust security controls and continuous auditing of AI agent development kits and their associated workflows.