Google dev kit spurs first-ever agent-on-agent violence
Poisoned pull requests contain prompt injection that allows one to control another
By The Register
Google’s Agent Development Kit for Python was the subject of a security report that researchers described as the first real-world agent-to-agent exploitation method. The Register said Pillar Security researchers found a flaw in the open-source google/adk-python repository that could let a lower-privilege AI agent trigger a higher-privilege one and compromise supply chains.
According to the report, the issue affected a public-facing agent used for pull requests and issues, and a separate maintainer-only agent with more privileges. The researchers said the lower-privilege agent could be manipulated through prompt injection, allowing an attacker to reach the privileged workflow and execute a malicious action.
The report said the attack involved creating pull requests, including one with malicious content and another containing the prompt injection that would cause the trusted handoff to fire. It said Google has already fixed the underlying issue in the repository, although it deemed the exploit non-rewardable because it involved social engineering.
The Register said the vulnerability illustrated risks in using AI agents for triage, pull request reviews and discussions in CI/CD workflows. No police, council, parents, residents or customers were mentioned in the report.