Google ADK Flaws Show How Prompt Injection Can Escalate Privileges

Security researchers at Pillar Security have uncovered critical vulnerabilities in the GitHub repository for Google's Agent Development Kit (ADK) for Python. The flaws allowed attackers to use prompt injections within public issues or pull requests to deceive AI agents into triggering high-privilege automation workflows.

These vulnerabilities centered on "transitive authority," where a low-privilege agent's output is trusted by a more powerful system. In one scenario, a triage agent analyzing external pull requests could be manipulated via malicious instructions to post an '@gemini-cli' command. This action triggered a workflow intended only for trusted users, potentially allowing an attacker to alter maintainer comments or submit approving reviews under the 'github-actions[bot]' identity. Such manipulation would make malicious pull requests appear legitimate and ready for merging.

The Risk of Natural Language Authorization

The Google ADK is a code-first framework designed for building and deploying AI agents. However, the vulnerabilities found in its own repository demonstrate a systemic risk in how AI agents interact with CI/CD pipelines. By treating natural language as a trigger for privileged actions, the system created a path for unauthorized escalation.

Sanchit Vir Gogia, chief analyst at Greyhound Research, noted that "natural language has joined the authorization path." He explained that an attacker no longer needs direct merge rights if they can "manufacture the evidence that persuades someone else to merge."

Credential Exposure and Industry Impact

A second attack path involved an Antigravity-based agent. Researchers found that prompt injections in public issues could trigger a fixing workflow, which was subsequently used to extract sensitive data. This included the adk-bot personal access token and a Google Cloud service account key.

This case highlights a new class of security risk where AI agents act as conduits for privilege escalation. It proves that attackers do not need direct system access if they can manipulate an agent into exercising the system's authority. For enterprises, this necessitates a fundamental reconsideration of how trust and authority are managed in multi-agent systems and automated pipelines.

Remediation and Outlook

Google has since addressed the vulnerabilities. The company confirmed that the affected workflows were removed by July 2, and the second issue involving the Antigravity-based agent was fixed by July 21.

As AI agents are increasingly integrated into software development lifecycles, the industry must now determine how to isolate agent outputs from privileged execution environments to prevent similar prompt-based exploits.