Researchers find ‘agent-to-agent’ privilege escalation in Google’s ADK for Python repo

Google’s Agent Development Kit for Python (adk-python) repository on GitHub was found to be susceptible to an “agent-to-agent” privilege escalation exploit, Pillar Security researchers said Monday.

Exploiting the flaw could have led to extraction of a GITHUB_TOKEN that could then be used to modify pull request (PR) comments and impersonate contributors for social engineering, Pillar demonstrated. A second, similar exploit abusing the repo’s use of an Antigravity SDK-based agent for issue triage was further demonstrated to lead to exposure of a Google Cloud Platform (GCP) service account key. Google has since fixed both flaws.

The first vulnerability stemmed from a workflow, pr-triage.yml, that used an AI agent called "adk_pr_triaging_agent" to automatically comment on and label PRs. Pillar found that this agent commented from a user account named "adk-bot" with Collaborator privileges, rather than a typical bot account. They also found that two privileged agentic workflows — gemini-invoke.yml and gemini-review.yml — were triggered on the repo when a Collaborator published a comment that started with ”@gemini-cli” or “@gemini-cli /review,” respectively.   

Seeing an opportunity to trigger the higher-privileged workflows by manipulating adk-bot, the researchers crafted a PR containing a prompt injection that led the agent to publish a specific comment starting with "@gemini-cli." This comment triggered the gemini-invoke.yml workflow and contained an additional prompt injection causing this workflow’s agent to leak all tools it had access to.

After realizing that they could use this agent-to-agent prompt injection technique to run bash commands on the repo’s GitHub Actions runner and extract the GITHUB_TOKEN, the researchers then developed an exploit chain that leveraged the agentic workflows along with the token’s “pull-requests: write”  and “issues: write” permissions to modify the comments on a malicious PR.

Related reading

One PR would be created aiming to add malicious code to the project while a second PR would be used to trigger adk-bot after a human triager commented on the first PR. Adk-bot would be prompted to prompt gemini-invoke to leverage the GITHUB_TOKEN to edit the human contributor’s comment to appear like an approval and a request for an agentic code review rather than a human review as originally intended. A gemini-review event would be created via GitHub Actions and the comments and actions would ultimately make it appear as though the changes were fully approved, and the PR was ready to be merged.

“This report demonstrates exfiltration of a GitHub token with a ‘pull-requests: write’ permission, which enables tampering with a PR but still requires a maintainer to take an action to merge the malicious PR as PRs are not automatically merged after a bot review,” Google noted in its response to the researchers. “We don’t reward vulnerability reports that require social engineering to enable a supply chain security compromise. Nonetheless, we have taken action to harden the repository so we will be recognizing this report with credit.”

The second flaw involving the Antigravity SDK-based agent exploited a workflow called "issue-analyze.yml," which is triggered automatically when an issue or PR is opened, and similarly leads adk-bot to comment on select issues and PRs. A second higher-privileged workflow, "issue-fix.yml," is triggered when a Collaborator, Member or Maintainer account comments "/adk-issue-fix" on an issue, and causes an Antigravity agent to open a pull request and write code to fix the issue.

Using the same agent-to-agent prompt injection technique, the researchers could cause adk-bot to comment /adk-issue-fix and invoke the Antigravity agent. The Antigravity agent was found to have a deny policy on its run_command tool that blocked a set of shell metacharacters and only allowed command starting with gh or git, which the researchers found was insufficient to prevent arbitrary code execution and file writes.

The researchers were able to trigger the agent via adk-bot’s comment to run commands on the CI runner that leaked environment variables including ADK_TRIAGE_AGENT, GOOGLE_API_KEY and ADK_GCP_SA_KEY. The former is the long-lived personal access token (PAT) for adk-bot while the latter is a service account key for the adk-python GCP project. However, the researchers could not confirm the privilege scope of either of these secrets. Google confirmed this issue was fixed on July 21, 2026.

Pillar noted that these agent-to-agent exploits demonstrate how agentic workflows can reshape privilege boundaries and advises security teams to assume any agent that processes untrusted inputs can be controlled by an attacker.

“Don’t tie agents to human user accounts or long-lived personal access tokens with broad collaborator privileges; give them their own narrowly-scoped, auditable identities. Make sure no agent can trigger another across a privilege boundary without a control a prompt injection can’t forge,” the researchers concluded.