Security flaws in automated workflows within the GitHub repository for Google's Agent Development Kit for Python allowed public-facing AI agents to activate more privileged automation, according to a report from Pillar Security. The vulnerabilities created two distinct attack paths: one that could manipulate pull-request reviews and another capable of exposing credentials. Pillar Security described the findings as the "first practical, real-world case of agent-to-agent exploitation" involving a production multi-agent system.
The first attack path targeted a triage agent that examined pull requests from external contributors. The agent published its responses through adk-bot, an account holding collaborator access to the repository. Pillar discovered that malicious instructions hidden in a pull request could trick the agent into posting an "@gemini-cli" command, which activated a workflow meant for trusted users. That workflow enabled command execution inside its CI runner. Though its GitHub token couldn't push code, it had write access to issues and pull requests. Those permissions could alter a maintainer's comment, submit an approving review as github-actions[bot], and remove a legitimate review request, making a malicious pull request look ready to merge. A second attack path in newer workflows built around an Antigravity-based agent allowed an attacker to plant a prompt injection in a public issue and induce an analysis agent to post the command that launched a fixing workflow reserved for trusted repository users. The fixing workflow tried to restrict the agent to Git and GitHub commands, but Git could still launch arbitrary code. Researchers showed that the adk-bot personal access token could be extracted from the runner to an attacker-controlled server, while a Google Cloud service account key was also available to the workflow. Pillar confirmed on July 2 that the affected workflows had been removed, and Google told the researchers on July 21 that the second issue had been fixed.
The report identifies natural language as a new element in authorization paths. Sanchit Vir Gogia, chief analyst at Greyhound Research, said "Natural language has joined the authorization path." Gogia said an agent's authority should be measured not only by its assigned tools but also by the more privileged systems its output can trigger or influence. Sakshi Grover, senior research manager for IDC Asia Pacific Cybersecurity Services, said CISOs should determine materiality by tracing three things: which agents consume untrusted content such as pull requests, issues, emails, support tickets, or external documents; whether the output of those agents can directly or indirectly trigger another agent or workflow with higher privileges; and what the maximum effective capability is of the identities, credentials, and tools involved. The report notes that existing security tools may provide only a partial view of how authority moves between agents and workflows, with IAM, PAM, CIEM, and application-security tools able to expose individual identities, permissions, and unsafe workflow configurations but potentially unable to recognize that those components form a single event-driven delegation path.
The report explains that the vulnerabilities reveal how agentic workflows can turn trusted repository signals into privilege-escalation paths that conventional identity and CI/CD controls may not catch. Even human approval doesn't necessarily close the gap. Although the first attack path still required a maintainer to merge the pull request, the manipulated automation could influence the evidence presented to the maintainer. "An attacker needs no merge rights when it can manufacture the evidence that persuades someone else to merge," Gogia said. Security teams should follow external input from the point it reaches an agent through to any downstream system that acts on the result, according to the report. The review should also account for handoffs embedded in shared workflow state, such as a comment that triggers a command. Approval should bind an independently authenticated reviewer to the exact code or artifact examined, with any material change invalidating that approval. Changes to reviews, comments, and approval states should be treated as security events and exported to an independent logging system that the workflow's own identity can't alter. Organizations deploying multi-agent systems will need to rethink how they map authority flows, recognizing that the question isn't just whether one agent can call another but whether one agent can alter anything another agent already trusts. The shift toward natural language as an authorization vector forces a choice between the efficiency gains of agentic automation and the overhead required to trace every possible delegation chain through production systems.