Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent

Summary

Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository after Pillar Security demonstrated that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent. No in-the-wild exploitation was identified.

Details

The researchers showed the public agent could be prompt-injected to post as adk-bot, with the trusted bot identity serving as the authorisation bridge, enabling arbitrary code execution on the CI runner and exfiltration of a bot personal access token and Google Cloud credentials. The vulnerability exploited the agentic workflow pattern where a lower-privilege triage agent had the ability to invoke a higher-privilege code-fixing agent — a trust boundary violation that mirrors the Prompt Injection risks increasingly identified in AI agent architectures. This follows the broader pattern of AI security incidents driving regulatory and governance responses from organisations such as the Acsc and UK NCSC.

Sources

• The Hacker News
• raw/digests/Cyber-Digest-2026-08-05