Security vulnerabilities discovered in the GitHub repository for the Google Agent Development Kit for Python show how public AI agents can trigger unauthorized, high-privilege automation. These flaws allowed external contributors to manipulate code reviews and expose sensitive credentials. Google corrected the issues after researchers from Pillar Security reported the potential for exploitation.
Exploitation paths in automated repositories
The primary risk involved a triage agent designed to evaluate pull requests from outside contributors. This agent functioned using a specific account that held collaborator status within the repository. Researchers found that a malicious actor could embed specific instructions within a pull request to trick the agent. This trickery forced the agent to issue commands that activated workflows normally reserved for trusted internal users.
Once these workflows were active, they allowed for the execution of commands within the continuous integration environment. Although the associated tokens could not directly push code, they possessed the power to modify issues and pull requests. An attacker could use these permissions to change comments made by maintainers or submit fake approvals. This activity created a situation where a dangerous pull request appeared legitimate and ready for final merging.
