Executive Summary
Pillar Security researchers discovered a critical multi-agent exploitation path in Google's Agent Development Kit (ADK) Python repository. The vulnerability allowed a low-privileged, public-facing triage agent to be manipulated via prompt injection into triggering a high-privileged code-fixing agent. By using a trusted bot identity (adk-bot) as an authorization bridge, attackers could bypass repository gates intended for maintainers only.
Technically, the attack involved crafting a malicious GitHub issue that forced the triage agent to post a command triggering the 'issue-fix.yml' workflow. This privileged workflow ran with high-value secrets, including a long-lived Personal Access Token (PAT) and a Google Cloud service account key. The researchers demonstrated that the agent's command allowlist could be bypassed using Git hook path redirection, resulting in full remote code execution (RCE) on the CI runner.
This case represents the first real-world demonstration of agent-to-agent privilege boundary failure. While Google has since removed the affected workflows and hardened the repository, the incident highlights a significant new attack surface in AI-integrated CI/CD pipelines where instructions can be forged through natural language.