[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fP_EPs9KE-kHvf0nVz6-Brd6zym2LusSCSypPOaJnuE4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"4303cf84-0ed6-4398-966b-55e03fb6a3c8","malicious-github-issue-exploits-privileged-ai-agent-in-google-adk-repo","284cac6c-4860-48e6-88a3-a111995a3f63","Malicious GitHub Issue Exploits Privileged AI Agent in Google ADK Repo","A publicly accessible GitHub issue was weaponized to trigger a privileged CI\u002FCD agent in Google's ADK Python repository, enabling arbitrary code execution on the CI runner. The root problem was that an automated code-fixing agent operated with excessive privileges and lacked proper input validation against untrusted public input. This exposed sensitive credentials — including a bot Personal Access Token (PAT) and Google API key — to potential exfiltration. The incident highlights the growing attack surface introduced by AI-powered automation workflows embedded in CI\u002FCD pipelines. Granting elevated permissions to agents that process untrusted, user-supplied content is a critical misconfiguration that can undermine an entire software supply chain.","**Immediate actions:**\n- Audit all CI\u002FCD automation workflows and agents for excessive privilege levels and revoke unnecessary permissions immediately.\n- Rotate any potentially exposed secrets (PATs, API keys) and store them in a dedicated secrets manager rather than as plain environment variables.\n- Restrict automated agents from acting on untrusted public inputs (e.g., issue comments, PR descriptions) without human approval gates.\n\n**Long-term improvements:**\n- Apply the principle of least privilege to all CI\u002FCD agents, scoping permissions to only the specific repository actions required.\n- Implement separate, isolated runner environments for workflows triggered by public\u002Funtrusted sources versus internal contributors.\n- Establish a formal review and approval process before deploying new AI-powered automation workflows in repositories with elevated access.\n\n**Detection measures:**\n- Enable detailed audit logging for all CI\u002FCD pipeline executions and alert on unexpected outbound network connections from runners.\n- Implement secret scanning tools (e.g., GitHub Advanced Security, Trufflehog) to detect accidental credential exposure in workflow logs and artifacts.\n- Monitor for anomalous agent behavior, such as unusual API calls or file access patterns, using runtime security tooling on CI runners.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 4: Controlled Use of Administrative Privileges","CIS Control 6: Access Control Management","CIS Control 16: Application Software Security","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 SA-15: Development Process, Standards, and Tools","NIST SP 800-204C: DevSecOps for Microservices-Based Applications","SLSA Supply Chain Levels for Software Artifacts (Level 3: Isolated Build Environments)","OWASP CI\u002FCD Security Top 10: CICD-SEC-4 Poisoned Pipeline Execution (PPE)","OWASP CI\u002FCD Security Top 10: CICD-SEC-6 Insufficient Credential Hygiene",{},"published","2026-08-04T14:22:08.084994+00:00","2026-08-04T14:22:07.971+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fgoogle-deletes-3-adk-ai-workflows-after.html","google-deletes-3-adk-ai-workflows-after-malicious-github-issue-could-trigger-pri-06b31a","Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":44,"name":45,"slug":46,"description":47,"color":48},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[51,55,59],{"slug":52,"name":53,"problem":54},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":56,"name":57,"problem":58},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":60,"name":61,"problem":62},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught."]