Security researchers at Pillar Security have uncovered what they describe as the first real-world method for one AI agent to exploit and control another, exposing a vulnerability in the repository powering Google's Agent Development Kit for Python. The flaw, now patched, allowed attackers to manipulate a low-privilege public AI agent through prompt injection to trigger a high-privilege maintainer agent capable of executing harmful actions. The toolkit, google/adk-python, is an open source Python resource with over 90 million downloads used for building and deploying AI agents.
The vulnerability arose from how the repository operated two types of automated AI agents with differing privilege levels that inadvertently shared a trust boundary, according to Pillar's findings. A low-privilege, public-facing agent activated when users opened pull requests or issues could be manipulated to activate a second, high-privilege maintainer-only agent. The attack required an attacker to first make legitimate contributions to build trust among maintainers before deploying the prompt injection. The exploit worked by creating a pull request combining genuine fixes with malicious code, then opening a second pull request containing the prompt injection that triggered the privileged agent workflow. Google fixed the underlying issue but declined to award a bug bounty, stating the exploit required social engineering and that pull requests still needed manual maintainer approval for merging.
Dan Lisichkin, the Pillar researcher who discovered and reported the vulnerability, writes that "our world is changing quickly, and new attack surfaces are not yet reflected in threat models because these attacks never could exist in the first place in the 'pre-agent' world." The research demonstrates the risks of deploying AI agents in CI/CD workflows for triage, pull request reviews, and discussions, according to the technical write-up published Monday. Lisichkin will present the findings during a poster talk at DEF CON's AI Village on Friday, August 7 at 1600 PDT. Google responded that the report "demonstrates exfiltration of a GitHub token with a 'pull-requests: write' permission, which enables tampering with a PR but still requires a maintainer to take an action to merge the malicious PR," and therefore didn't qualify for monetary reward despite the company hardening the repository.
The exploit illustrates how agent isolation alone won't protect production environments from these emerging threats, the report explains. Because the workflows showing how agents operate behind the scenes are publicly visible, any individual could theoretically connect how one agent might trigger another. Building the actual attack required only English-language skills for crafting the prompt injection, or simply asking an AI to construct it. The chained attack manufactured a complete, believable trail suggesting a human requested a review, an AI ran it, and the AI approved it, none of which actually occurred. Lisichkin warns that CISOs and security practitioners should begin considering these scenarios in their threat modeling and calculating worst-case implications and blast radius. The research shows agents need their own identity that mandates what resources they can access and how they can interact with those resources—had Google assigned a distinct bot identity to the initial triaging agent, most of the attack could have been prevented. Organizations integrating AI agents into development workflows face a new class of supply chain risks that traditional security models weren't designed to address. The technology sector will need to fundamentally rethink permission boundaries and trust relationships as autonomous systems become more deeply embedded in critical infrastructure.