Flaw in Google's Agent Dev Kit enables first AI agent-on-agent attack
Pillar Security found a flaw in Google's ADK Python repo letting one AI agent hijack another, the first known agent-to-agent supply chain exploit.
Researchers at Pillar Security uncovered a vulnerability in Google's open-source Agent Development Kit for Python (google/adk-python), a repo with over 90 million downloads, that let one AI agent manipulate another into executing malicious actions. The team describes it as the first documented real-world case of agent-to-agent exploitation.
The root cause was an unintended shared trust boundary between two agent classes: a low-privilege agent triggered by any public PR or issue, and a high-privilege, maintainer-only agent. Using prompt injection across two staged pull requests, an attacker could manipulate the public agent into invoking the privileged @gemini-cli agent, fabricating a convincing but fake 'human requested review, bot approved' audit trail.
Google patched the underlying issue but declined to pay a bug bounty since the exploit required social engineering to build maintainer trust first. The case highlights a new, largely unmodeled attack surface as AI agents get embedded into CI/CD pipelines for triage and code review. The researcher argues that agent isolation alone isn't sufficient — agents need distinct identities and scoped resource permissions to prevent this class of attack.