Researchers from Pillar Security disclosed a real-world attack in Google’s ADK for Python where a low-privilege AI agent can manipulate a higher-privilege agent to perform actions beyond its own permissions in CI/CD workflows.

The attack hinges on two overlapping agent classes in CI/CD: a public-facing, low-privilege agent active during PRs and issues, and a maintainer-only high-privilege agent, whose trust boundary is unintentionally shared.

Critical vulnerabilities in the Google ADK for Python could let public agents trigger high-privilege automation via malicious pull requests and issue comments.

Security guidance calls for mapping delegation paths, independent logging of decisions and approvals, tying approvals to immutable code versions, and preventing logs from being altered by automated workflows.

Key details include the workflows involved (pr-triage.yml, gemini-invoke.yml, gemini-review.yml, issue-analyze.yml, issue-fix.yml) and the nature of vulnerabilities (prompt injection, token leakage, and privileged actions on PRs and issues).

Findings stress redefining authority in agentic systems, securing human-in-the-loop processes, and recognizing that automated systems can be manipulated through legitimate automation to bypass safeguards.

Google cleaned up by removing the three workflows in June 2026; Pillar Security verified removals by July, with Google announcing completion later that month; verification appeared archived in August underlines the fix.

The report notes the attack would require the attacker to earn legitimate contributions to build trust, making social engineering plausible but non-trivial.

Evidence showed the extracted GitHub token, while narrowly scoped, allowed editing comments, impersonating maintainers, and triggering fake approvals, creating a believable approval trail without human review.

Google was notified and addressed the issue in stages, with hardening and patches by late July, though initial bug bounty considerations varied.

Attackers could manipulate code reviews or exfiltrate credentials from CI environments, leading Google to harden repositories and remove affected workflows.

The exploit did not require deep coding knowledge; plain-English prompts could cause regular bots to trigger commands carried out by the master bot.