Full Report
Poisoned pull requests contain prompt injection that allows one to control another
Analysis Summary
# Vulnerability: Agent-to-Agent Prompt Injection in Google ADK-Python CI/CD
## CVE Details
- **CVE ID:** Not Assigned (Google deemed the report non-rewardable as it involved social engineering/human-in-the-loop components).
- **CVSS Score:** N/A (Estimated High impact on Integrity/Confidentiality if successful).
- **CWE:** CWE-506: Embedded Malicious Code; CWE-116: Improper Encoding or Escape of Output (Prompt Injection).
## Affected Systems
- **Products:** Google Agent Development Kit (ADK) for Python.
- **Versions:** Impacted versions prior to August 2026 fix (specific version numbers not disclosed, but repository has over 90 million downloads).
- **Configurations:** GitHub repositories using automated AI agents for CI/CD workflows, specifically those using `google/adk-python` to triage pull requests (PRs) and manage discussions.
## Vulnerability Description
The flaw involves a **privilege boundary failure** between two classes of AI agents:
1. **Low-Privilege Agent:** A public-facing agent that triages new PRs and issues.
2. **High-Privilege Agent:** A maintainer-level agent with a Personal Access Token (PAT) capable of executing gated workflows.
An attacker can use **prompt injection** within a PR's text to manipulate the low-privilege agent. Because the low-privilege agent's output is trusted by the high-privilege agent, the attacker can force the low-privilege agent to emit a specific command (e.g., `@gemini-cli handoff`). This triggers the privileged agent to execute malicious actions, such as exfiltrating GitHub tokens or approving poisoned code, under the guise of an automated bot review.
## Exploitation
- **Status:** PoC demonstrated by Pillar Security; confirmed fixed by Google.
- **Complexity:** Medium (Requires "social engineering" by building repo trust/contribution history first).
- **Attack Vector:** Network (Remote via GitHub PR/Issue submission).
## Impact
- **Confidentiality:** High (Ability to exfiltrate GitHub PATs with `pull-requests: write` permissions).
- **Integrity:** High (Ability to spoof bot approvals on malicious PRs and tamper with codebase dependencies).
- **Availability:** Low (Primary focus is supply chain compromise rather than DoS).
## Remediation
### Patches
- Google has updated and hardened the `google/adk-python` repository to prevent the handoff manipulation. Users should ensure they are using the latest version of the toolkit and updated CI/CD workflow templates.
### Workarounds
- **Agent Identity Management:** Assign unique, limited identities to bots rather than sharing high-privilege collaborator tokens.
- **Human-in-the-loop:** Ensure mandatory manual approval for all merges, regardless of bot "approval" status.
- **Input Sanitization:** Treat all text within PRs and issues as untrusted input that must not be allowed to trigger privileged command strings.
## Detection
- **Indicators of Compromise:**
- Unusual sequences of bot commands (e.g., `@gemini-cli`) appearing in PRs from external contributors.
- Bot approvals on PRs containing suspicious dependency changes (e.g., `package.json` modifications).
- **Detection Methods:** Monitor GitHub Actions logs for unauthorized token usage or unexpected workflow triggers initiated by bot accounts.
## References
- **Vendor Advisory:** hxxps[://]github[.]com/google/adk-python
- **Researcher Write-up:** hxxps[://]www[.]pillar[.]security/blog/ill-just-call-you-agent-to-agent-privilege-boundary-failures-in-ci-cd-on-googles-adk-repository
- **DEF CON Presentation:** hxxps[://]aivillage[.]org/posters/ill-just-call-you-agent-to-agent-privilege-boundary-failures-in-ci-cd/