[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHyf9fyAYGKy9CKPEkwW3OBQaQSRsQEodc9azRLjWrMA":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"fd3db983-a8a1-44ce-86cf-8102df39490f","Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering","gemini-agent-to-agent-attack-method-exposed-secrets-enabled-pull-request-tamperi-9e22e7","A crafted prompt to a low-privilege Google ADK agent could be used to pass a malicious hand-off comment to a privileged agent. The post Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering appeared first on SecurityWeek.","Pillar Security discovered a critical vulnerability in Google's Agent Development Kit (ADK) for Python that allowed attackers to escalate privileges from low-privileged to high-privileged AI agents through crafted prompts. An attacker could manipulate the public-facing agent to hand off requests to restricted agents, gaining access to sensitive capabilities like command execution and GitHub tokens, enabling pull request poisoning and potential supply chain compromise. Google patched the issue but did not award a bug bounty, deeming social engineering required; a second vulnerability in the same codebase was later fixed in July.","Agent-to-agent attack in Google ADK Python allows privilege escalation and PR tampering via prompt injection.","https:\u002F\u002Fwww.securityweek.com\u002Fgemini-agent-to-agent-attack-exposed-secrets-enabled-pull-request-tampering\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F04\u002FGemini.jpeg","2026-08-04T10:54:30+00:00","2026-08-04T12:00:05.148706+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"Google","vendor",{"name":21,"type":22},"Agent Development Kit (ADK) for Python","product",{"name":24,"type":22},"Antigravity-SDK",{"name":26,"type":27},"MCP server","technology",{"name":29,"type":27},"GitHub",{"name":31,"type":19},"Pillar Security","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[],[18,31,21],{"controls":56,"vendors":135},[57,85,110],{"slug":58,"name":59,"problem":60,"products":61},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[62,70,77],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":58,"product_name":74,"url":75,"description":76},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":86,"name":87,"problem":88,"products":89},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[90,97,102],{"vendor_slug":91,"vendor_name":29,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":98,"product_name":99,"url":100,"description":101},"idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":52,"name":111,"problem":112,"products":113},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":131,"product_name":132,"url":133,"description":134},"prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",[136],{"slug":137,"name":18,"logo_path":138,"roles":139},"google","\u002Fvendor-logos\u002Fgoogle.png",[140],"affected",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":157},"ai-agent-privilege-escalation-exposes-secrets-and-enables-supply-chain-attacks","AI Agent Privilege Escalation Exposes Secrets and Enables Supply Chain Attacks","A critical flaw in Google's Agent Development Kit allowed attackers to craft prompts that tricked low-privileged AI agents into delegating requests to high-privileged agents, bypassing intended access boundaries. This privilege escalation granted unauthorized access to sensitive capabilities including command execution and GitHub tokens, enabling attackers to tamper with pull requests and potentially compromise software supply chains. The vulnerability highlights that AI agent architectures introduce new attack surfaces where trust boundaries between agents must be explicitly enforced, not assumed. Treating prompt injection as merely a 'social engineering' issue underestimates its severity when it can directly escalate privileges and expose credentials in automated pipelines.",[146,147,148,149,150,151,152,153,154,155,156],"CIS Control 4: Controlled Use of Administrative Privileges","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST AC-2: Account Management","NIST AC-6: Least Privilege","NIST SA-11: Developer Testing and Evaluation","NIST SR-6: Supplier Assessments and Reviews","OWASP LLM01: Prompt Injection","OWASP LLM09: Overreliance","NIST AI RMF: GOVERN 1.2, MAP 2.3","SLSA Supply Chain Framework: Build Integrity",{}]