Researchers uncover prompt-injection path between Google AI agents

Researchers say they identified a supply-chain attack technique in the GitHub repository for Google’s Agent Development Kit (ADK) for Python, in which a lower-privileged AI agent could be manipulated into activating a more powerful one.

The issue was found in google/adk-python, an open-source toolkit reportedly downloaded more than 90 million times. Pillar Security researcher Dan Lisichkin described the finding as an example of “agent-to-agent” exploitation, a class of attack that has emerged as organizations increasingly use AI systems in software development and CI/CD processes.

How the attack worked

The repository used two automated agents with different roles. A public-facing agent handled pull requests and issues, while a maintainer-only agent had access to more sensitive actions. According to Pillar, the systems’ workflows and permissions created an unintended trust relationship.

An attacker could first submit a seemingly legitimate pull request containing a malicious change, such as an altered dependency. After the public agent processed that contribution, the attacker could submit another pull request containing instructions designed to manipulate the agent through prompt injection. The resulting output could then trigger a handoff to the privileged agent, which might perform an action on the attacker’s behalf.

Executing the full attack would likely require an attacker to establish credibility through earlier contributions. It also would not automatically merge a malicious pull request: a maintainer would still need to approve or merge the change. Nevertheless, the researchers said the sequence could create a misleading record suggesting that a human had requested a review and that an AI agent had approved it.

Google’s response

Google fixed the underlying repository issue and credited the report, but said it did not qualify for a bug-bounty payment because exploiting it depended on social engineering and still required maintainer action. The company said the exposed token could modify pull requests but could not independently merge them.

Lisichkin said the incident demonstrates that separating agents by function is not sufficient. He recommended assigning each agent a distinct identity and explicitly limiting the resources and interactions available to it. Security teams, he added, should incorporate agent identity, permissions, and potential blast radius into threat models for AI-enabled development systems.