Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent
Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository following a security disclosure by Pillar Security. The researchers demonstrated that a public GitHub issue could be used to manipulate a triage agent via prompt injection, causing it to post the command "/adk-issue-fix" as the adk-bot. Because the adk-bot was identified as a collaborator, that comment satisfied the conditions to trigger a privileged code-fixing agent. The attack chain relied on the public agent being susceptible to prompt injection, which allowed the malicious instruction to be embedded in the issue. The deletion of the workflows was a direct response to this vulnerability, as reported by The Hacker News. The incident highlights the risks associated with AI agents that operate on public-facing platforms and the potential for prompt injection to escalate privileges.
Prompt injection in public AI agents can escalate to privileged actions, as shown by this ADK workflow removal.