VulnerabilitiesAug 4, 2026

Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering

Agent-to-agent attack in Google ADK Python allows privilege escalation and PR tampering via prompt injection.

Pillar Security discovered a critical vulnerability in Google's Agent Development Kit (ADK) for Python that allowed attackers to escalate privileges from low-privileged to high-privileged AI agents through crafted prompts. An attacker could manipulate the public-facing agent to hand off requests to restricted agents, gaining access to sensitive capabilities like command execution and GitHub tokens, enabling pull request poisoning and potential supply chain compromise. Google patched the issue but did not award a bug bounty, deeming social engineering required; a second vulnerability in the same codebase was later fixed in July.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Google?

Get an email when a new story names Google, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

A critical flaw in Google's Agent Development Kit allowed attackers to craft prompts that tricked low-privileged AI agents into delegating requests to high-privileged agents, bypassing intended access boundaries. This privilege escalation granted unauthorized access to sensitive capabilities including command execution and GitHub tokens, enabling attackers to tamper with pull requests and potentially compromise software supply chains. The vulnerability highlights that AI agent architectures introduce new attack surfaces where trust boundaries between agents must be explicitly enforced, not assumed. Treating prompt injection as merely a 'social engineering' issue underestimates its severity when it can directly escalate privileges and expose credentials in automated pipelines.

What helps against this

How we list vendors

Google affected

Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
For exampleWALLIX PAM ThreatLocker Privileged Access Management Palo Alto Networks Idira Privileged Access Management all options
Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
For exampleGitHub Advanced Security Palo Alto Networks Idira Secrets Management HashiCorp Vault all options
AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
For exampleBoomi Agentstudio HiddenLayer AI Security Platform Palo Alto Networks Prisma AIRS all options

Entities

Google (vendor)Agent Development Kit (ADK) for Python (product)Antigravity-SDK (product)MCP server (technology)GitHub (technology)Pillar Security (vendor)