Google has removed three AI workflows from its Agent Development Kit (ADK) Python repository after security researchers discovered a serious vulnerability involving GitHub Issues. The flaw showed that a carefully crafted public GitHub issue could manipulate an AI-powered triage agent into triggering a more privileged code-fixing agent. Although the attack was demonstrated in a controlled environment, researchers confirmed there is no evidence that the vulnerability was exploited in real-world attacks.
The issue was discovered by researchers at Pillar Security while analyzing Google’s AI-assisted development workflows. They found that an attacker could submit a malicious GitHub issue containing hidden prompt injection instructions. Instead of simply reviewing the issue, the AI triage agent could unknowingly pass those instructions to another AI agent with higher privileges, allowing the attacker to influence actions that should never have been exposed to untrusted users.
During their proof-of-concept, the researchers demonstrated that the privileged AI agent could be tricked into executing arbitrary code on Google’s continuous integration (CI) runner. They also showed that sensitive credentials, including the bot’s personal access token (PAT), could be accessed. In addition, the privileged workflow had access to a Google API key and a Google Cloud service account credential, making the potential impact much more serious if abused.
According to the researchers, the attack relied on prompt injection rather than a software bug in the traditional sense. The malicious instructions were hidden inside a GitHub issue, where the AI agent interpreted them as legitimate commands. Because one AI agent trusted the output of another without proper validation, the attack created a chain reaction that allowed low-privileged input to influence a high-privileged workflow.
After receiving the report, Google quickly investigated the findings and removed the three affected AI workflows from its public ADK repository. The company also worked with the researchers to understand the attack path and reduce the risk of similar AI agent interactions in the future. Google stated that the demonstration did not result in a compromised ADK release, and there is currently no indication that any users or repositories were affected by the issue.
The incident highlights a growing security challenge as AI agents become more common in software development. Many modern development platforms use AI to review issues, label bugs, generate code fixes, and automate workflows. If these AI systems are given powerful permissions without strict safeguards, attackers may exploit prompt injection techniques to make the agents perform actions they were never intended to execute.
Security experts recommend that organizations treat AI agents like privileged software components instead of simple assistants. Workflows should follow the principle of least privilege, sensitive credentials should be isolated, and AI-generated outputs should always be verified before triggering high-risk actions. Public content such as GitHub issues, pull requests, and comments should never be automatically trusted when AI agents are involved.
This case serves as another reminder that AI security is becoming just as important as traditional cybersecurity. While AI agents can improve productivity, they also introduce new attack paths that organizations must understand and secure. Google’s quick response helped prevent a larger supply chain risk, but the research shows that developers must carefully design AI workflows to ensure that untrusted input cannot influence privileged systems.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
