Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering

Summary

Pillar Security discovered a critical vulnerability in Google's Agent Development Kit (ADK) for Python that allowed attackers to escalate privileges from low-privileged to high-privileged AI agents through crafted prompts. An attacker could manipulate the public-facing agent to hand off requests to restricted agents, gaining access to sensitive capabilities like command execution and GitHub tokens, enabling pull request poisoning and potential supply chain compromise. Google patched the issue but did not award a bug bounty, deeming social engineering required; a second vulnerability in the same codebase was later fixed in July.

Full text

Pillar Security discovered an agent-to-agent attack method in Google’s Agent Development Kit for Python that could lead to secret exposure and pull request (PR) poisoning. The google/adk-python repository had two classes of automated AI agents, namely low-privileged ones open to user interaction, and high-privileged ones accessible only to maintainers. An attacker could manipulate the low-privileged, public-facing agent to pass a prompt to the high-privileged one, gaining access to restricted capabilities, including command execution, and potentially opening the door to supply chain compromise, Pillar’s Dan Lisichkin explains. Initially, the company discovered that an agent responsible for triaging pull requests was commenting on PRs as a Collaborator, meaning it has high privileges on the repository. Next, Lisichkin found a way to manipulate the agent into posting an @gemini-cli <prompt> as a comment on a PR, which triggered gemini-invoke and provided access to a more privileged workflow. The initial prompt triggered a response from the gemini_invoke.yml workflow that leaked the tools the privileged agent had access to via the MCP server.Advertisement. Scroll to continue reading. This revealed that the bot had access to every bash command, meaning that the researcher could execute code remotely and potentially extract the agent’s GitHub token. According to Lisichkin, this allowed him to modify the comments, PRs, and issues of other maintainers, collaborators, and members; dismiss reviews or approve PR changes; and invoke gemini-invoke and gemini-review against any PR. This also enabled the researcher to poison the PR approval lifecycle, but any malicious PR would have to be approved and merged by a member, which required social engineering. The attack scenario would require a threat actor to build trust as a collaborator, then open a PR containing malicious code, which would be marked for review. The threat actor could then open a second PR containing prompts that would instruct the agent to mark the first PR as triaged, reviewed, and approved. “Editing the triager’s comment uses the impersonation primitive from issues: write; posting and approving as the bot uses the RCE-extracted GITHUB_TOKEN; the label and review-request changes fall under pull-requests: write. Strung together, they manufacture a complete, believable ‘a human asked for a review, Gemini ran it, Gemini approved’ trail on the poisoned PR, none of which ever happened,” Lisichkin notes. Google was notified of the finding in early June and addressed the issue through hardening, but did not consider it to meet the bar for a bug bounty reward, as it required social engineering to merge the malicious PR. Shortly after, Pillar discovered another vulnerability in the ADK repository, in the automation features of the Antigravity-SDK-based agent, which could lead to remote code execution without a maintainer’s interaction. Google fixed the weakness in late July. Related: Decades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks Related: Ruby on Rails Patches Critical Vulnerability Related: Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace Related: Critical Code Execution Vulnerability Patched in TeamCity Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Brinks Home Discloses Data Breach as Hackers Leak FilesRecent SonicWall Vulnerabilities Exploited in Ransomware AttacksRussian State APT Linked to Recent Public Wi-Fi Gateway HackingRuby on Rails Patches Critical VulnerabilityGoogle AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching PaceCritical Flaw Allowed to Azure Cosmos DB PwnageCareCloud Data Breach Impacts Over 350,000Critical Code Execution Vulnerability Patched in TeamCity Latest News Decades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks150,000 Impacted by Madera Community Hospital Data BreachMicrosoft Bug Bounty Program: $20 Million Paid to 500 ResearchersNew York Awards $9 Million to Strengthen Cybersecurity at 153 Water SystemsBlack Hat USA 2026 – Summary of Vendor Announcements (Part 1)Visa to Acquire Fraud Intelligence Firm BioCatch for $2.4 BillionCyberattack Hits Liechtenstein’s Register of People Behind Companies and FoundationsRiver Bank Says Hackers Deleted Data Stolen in Ransomware Attack Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MovePNC Financial Services Group has appointed Christian Winward as CISO.Brian Gumbel has joined Armadin as Chief Revenue Officer.EigenQ has appointed Mark Pecen as Vice Chairman and Alexander Truskovsky as CISO.More People On The MoveExpert Insights Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) The Shift Toward Business-Aligned Risk Management Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences. (Steve Durbin) Flipboard Reddit Whatsapp Whatsapp Email

Entities