Google Fixes 2 ADK Flaws Exposing Credentials and Manipulating Pull-Request Reviews
Updated
Updated · InfoWorld · Aug 4
Google Fixes 2 ADK Flaws Exposing Credentials and Manipulating Pull-Request Reviews
2 articles · Updated · InfoWorld · Aug 4
Summary
Pillar Security said Google hardened and then removed vulnerable Agent Development Kit workflows after finding two exploit paths in the Python ADK GitHub repository, with the second issue confirmed fixed on July 21.
One path let malicious pull requests steer a triage agent into posting an “@gemini-cli” command, which triggered a trusted-user workflow and could alter comments, approvals and review requests to make a bad pull request look merge-ready.
A separate issue let prompt injection in a public GitHub issue start an Antigravity-based fixing workflow; researchers showed they could use Git to run arbitrary code and extract the adk-bot token, while a Google Cloud service account key was also exposed.
Pillar called it a practical case of agent-to-agent exploitation, highlighting how untrusted natural-language input can transitively trigger higher-privilege systems even when a human maintainer still performs the final merge.
Analysts said enterprises should map that transitive authority across agents, workflows and shared state, and treat changes to reviews, comments and approval states as security events with independent logging.