Agent-to-Agent Exploitation Discovered in Google's ADK for Python

• •A vulnerability in Google's adk-python allows low-privileged agents to trigger high-privileged ones.
• •Exploitation could lead to unauthorized access to GitHub credentials and manipulation of pull requests.
• •Google has mitigated the vulnerabilities but considers the exploit non-rewardable due to social engineering.

Pillar Security researchers identified a vulnerability in Google's Agent Development Kit for Python (adk-python) that allows a low-privileged AI agent to trigger a high-privileged agent through prompt injection. This exploit could lead to the extraction of sensitive GitHub credentials, including a GITHUB_TOKEN, enabling unauthorized modifications to pull requests. The attack exploits workflows that allow public-facing agents to interact with more privileged automation, exposing a significant risk in CI/CD environments. Google has since mitigated the vulnerabilities but deemed the exploit non-rewardable due to its reliance on social engineering. This incident marks the first practical demonstration of agent-to-agent exploitation in a production environment, highlighting the need for updated threat models. The affected repository has over 90 million downloads, indicating a wide scope of potential impact. Security professionals are urged to reassess their threat models and consider the implications of AI agents in their workflows.