Security researchers uncovered a flaw that could let attackers manipulate Google’s Agent Development Kit into executing privileged code. Google responded by deleting three workflows.
Google’s Agent Development Kit (ADK) is a collection of Python workflows that help developers build and test automated agents.
The company recently removed three ADK workflows after a public issue posted on GitHub raised concerns about privilege escalation.
Pillar Security researchers highlighted that a public issue could trick a triage agent into launching a privileged code‑fixing agent.
The researchers explained that the public agent could be prompt‑injected into a posting endpoint called /adk-issue‑fix, effectively masquerading as adk-bot.
They identified the bot as a collaborator, which allowed the comment to satisfy the workflow’s requirement for a trusted collaborator.
The flaw would let an attacker supply a specially crafted issue body that the triage agent would interpret as a command to trigger the privileged agent.
In response, Google deleted the three affected workflows from the ADK Python repository, effectively cutting off the attack surface.
The company also issued a notice to developers, urging them to review the latest ADK documentation and update any workflows that could be exposed to public input.
This incident underscores the importance of strict input validation when building automated agents that can run privileged code.
Pillar Security will continue to monitor the ADK repository for further vulnerabilities and will release additional guidance for secure workflow design.
Google’s Agent Development Kit (ADK) is a collection of Python workflows that help developers build and test automated agents.
The company recently removed three ADK workflows after a public issue posted on GitHub raised concerns about privilege escalation.
Pillar Security researchers highlighted that a public issue could trick a triage agent into launching a privileged code‑fixing agent.
The researchers explained that the public agent could be prompt‑injected into a posting endpoint called /adk-issue‑fix, effectively masquerading as adk-bot.
They identified the bot as a collaborator, which allowed the comment to satisfy the workflow’s requirement for a trusted collaborator.
The flaw would let an attacker supply a specially crafted issue body that the triage agent would interpret as a command to trigger the privileged agent.
In response, Google deleted the three affected workflows from the ADK Python repository, effectively cutting off the attack surface.
The company also issued a notice to developers, urging them to review the latest ADK documentation and update any workflows that could be exposed to public input.
This incident underscores the importance of strict input validation when building automated agents that can run privileged code.
Pillar Security will continue to monitor the ADK repository for further vulnerabilities and will release additional guidance for secure workflow design.