Google has recently removed three AI agent workflows from its Agent Development Kit (ADK) Python repository following the discovery of a security vulnerability. This flaw, identified by Pillar Security, demonstrated that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent, potentially leading to unauthorized code execution.
The vulnerability allowed an attacker to prompt-inject the public agent into posting a specific command as ‘adk-bot.’ Since ‘adk-bot’ was recognized as a collaborator, this action satisfied the workflow’s authorization checks, effectively bypassing security measures. This exploit enabled arbitrary code execution on the continuous integration (CI) runner and exposed sensitive credentials, including the bot’s personal access token (PAT), a Google API key, and a Google Cloud service-account credential.
It’s important to note that the flaw resided in the repository’s automation processes, not in the distributed ADK Python package itself. To mitigate similar risks, Pillar Security recommends implementing separate bot identities, narrowing token and tool scopes, and ensuring that authorization signals cannot be generated from untrusted text.
The attack vector originated in the public ‘issue-analyze.yml’ workflow, which automatically ran upon the opening of an issue. This workflow authenticated using ‘ADK_GCP_SA_KEY,’ supplied credentials to Google’s Antigravity coding agent, and posted the generated analysis as a comment via the bot account. A separate ‘issue-fix.yml’ workflow monitored for specific comments and restricted execution to authorized users. However, the security check focused on the comment’s author, not on potential manipulation of the trusted account behind it.
The privileged job within this workflow had write access to issues, repository contents, and pull requests. These permissions applied to GitHub’s generated ‘GITHUB_TOKEN,’ not the ‘ADK_TRIAGE_AGENT’ PAT actually used. The exact scopes of the PAT were not publicly disclosed. The workflow was designed to edit code, create an ‘adk-bot’ fork, push a branch, and open a pull request, as evidenced by a bot-generated pull request from June 4.
While the runner rejected shell metacharacters and allowed only specific commands, the script enabled ‘CapabilitiesConfig(),’ which, according to Google’s Antigravity SDK documentation, activates all tools, including write capabilities. This configuration allowed the agent to write a payload and execute it through a custom Git hook path, effectively bypassing the command restrictions.
Public artifacts do not confirm whether the PAT could push directly to the main branch. Pillar Security reported that Google indicated the service account had Vertex AI access in a dedicated GitHub-management project, but broader permissions were not disclosed. The report describes runner execution and credential exposure, but the full extent of the credentials’ reach remains unclear.
This incident underscores the critical importance of securing automated workflows and the potential risks associated with repository automation. Organizations should rigorously assess and fortify their CI/CD pipelines to prevent similar vulnerabilities, ensuring that authorization mechanisms are robust and resistant to manipulation.
