Full Report
Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security showed that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent. The researchers said the public agent could be prompt-injected into posting /adk-issue-fix as adk-bot. They identified the bot as a collaborator, so that comment satisfied
Analysis Summary
# Incident Report: Indirect Prompt Injection in Google ADK AI Workflows
## Executive Summary
Researchers at Pillar Security discovered a vulnerability in Google’s Agent Development Kit (ADK) where a public-facing AI triage agent could be manipulated via prompt injection. This manipulation allowed an attacker to trick a privileged "code-fixing" agent into executing unauthorized actions, potentially leading to unauthorized code modifications. Google responded by removing the vulnerable AI agent workflows from the repository.
## Incident Details
- **Discovery Date:** Not explicitly disclosed (Reported by Pillar Security)
- **Incident Date:** August 2024 (Approximate period of vulnerability disclosure)
- **Affected Organization:** Google (ADK Python Repository)
- **Sector:** Technology / Software Development
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Upon submission of a public GitHub issue.
- **Vector:** Indirect Prompt Injection.
- **Details:** An attacker submits a crafted GitHub issue containing malicious instructions designed to be parsed by the automated AI triage agent.
### Lateral Movement
- **Details:** The attack involved cross-agent communication. The compromised "Triage Agent" was manipulated into posting a specific command (`/adk-issue-fix`) as the `adk-bot`. Because the bot was recognized as a repository collaborator, this command acted as a trigger for a more privileged "Code-Fixing Agent."
### Data Exfiltration/Impact
- **Details:** No data exfiltration was reported; however, the impact involved the potential for unauthorized code generation and modification within the repository by the privileged agent.
### Detection & Response
- **How it was discovered:** Security research and proof-of-concept by Pillar Security.
- **Response actions taken:** Google deleted three specific AI agent workflows from the ADK Python repository to mitigate the risk.
## Attack Methodology
- **Initial Access:** Indirect Prompt Injection via public GitHub issues.
- **Persistence:** N/A (Exploit is triggered per-session/issue).
- **Privilege Escalation:** Exploiting trust relationships between AI agents; moving from a low-privileged public-facing agent to a privileged collaborator agent.
- **Defense Evasion:** Using natural language instructions to bypass traditional input validation.
- **Credential Access:** Leveraging the pre-existing "Collaborator" status and permissions of the `adk-bot`.
- **Discovery:** Identifying the command structure (`/adk-issue-fix`) used to trigger internal workflows.
- **Lateral Movement:** Agent-to-Agent communication manipulation.
- **Collection:** N/A.
- **Exfiltration:** N/A.
- **Impact:** Potential unauthorized code injection or repository manipulation.
## Impact Assessment
- **Financial:** Minimal; research-driven discovery.
- **Data Breach:** None reported.
- **Operational:** Disruption of automated workflows as Google had to remove the AI-driven features.
- **Reputational:** Highlights the emerging security risks in autonomous AI agent ecosystems.
## Indicators of Compromise
- **Network indicators:** N/A.
- **File indicators:** Deletion of vulnerable workflow files in the `google/adk` repository.
- **Behavioral indicators:** Unexpected GitHub comments from `adk-bot` triggering privileged commands immediately following a public issue submission.
## Response Actions
- **Containment measures:** Immediate removal of the vulnerable AI agent workflow definitions from the public repository.
- **Eradication steps:** Disabling the automated triage-to-code-fix pipeline.
- **Recovery actions:** Re-evaluating the security architecture of the ADK before re-implementing automated agents.
## Lessons Learned
- **Key takeaways:** AI agents that consume untrusted user input (like GitHub issues) must not be given the authority to trigger privileged actions or interact with internal bots without a human-in-the-loop.
- **What could have been done better:** Implementing strict output filtering on the triage agent and requiring multi-factor authorization (or human approval) for the "Code-Fixing" agent's execution.
## Recommendations
- **Human-in-the-Loop:** Require manual approval for any AI-generated code changes or privileged command executions.
- **Agent Isolation:** Treat output from public-facing AI agents as untrusted "User Input" even when passed to another internal agent.
- **Input Sanitization:** Implement robust prompt injection detection layers to filter malicious instructions within GitHub issues or tickets.