Pillar Security discovered an agent-to-agent attack method in Google’s Agent Development Kit for Python that could lead to secret exposure and pull request (PR) poisoning.
The google/adk-python repository had two classes of automated AI agents, namely low-privileged ones open to user interaction, and high-privileged ones accessible only to maintainers.
An attacker could manipulate the low-privileged, public-facing agent to pass a prompt to the high-privileged one, gaining access to restricted capabilities, including command execution, and potentially opening the door to supply chain compromise, Pillar’s Dan Lisichkin explains.
Initially, the company discovered that an agent responsible for triaging pull requests was commenting on PRs as a Collaborator, meaning it has high privileges on the repository.
Next, Lisichkin found a way to manipulate the agent into posting an @gemini-cli <prompt> as a comment on a PR, which triggered gemini-invoke and provided access to a more privileged workflow.
