Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent
Google deletes AI workflows after GitHub issue could trigger privileged agent.
Google removed three AI agent workflows from its ADK Python repository after Pillar Security discovered a vulnerability. A public GitHub issue could be manipulated to trigger a privileged code-fixing agent, leading to arbitrary code execution on the CI runner and potential exfiltration of sensitive credentials like a bot PAT and Google API key. The exposed component was the repository automation, not the ADK package itself.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA publicly accessible GitHub issue was weaponized to trigger a privileged CI/CD agent in Google's ADK Python repository, enabling arbitrary code execution on the CI runner. The root problem was that an automated code-fixing agent operated with excessive privileges and lacked proper input validation against untrusted public input. This exposed sensitive credentials — including a bot Personal Access Token (PAT) and Google API key — to potential exfiltration. The incident highlights the growing attack surface introduced by AI-powered automation workflows embedded in CI/CD pipelines. Granting elevated permissions to agents that process untrusted, user-supplied content is a critical misconfiguration that can undermine an entire software supply chain.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.