Google Deletes Three ADK Workflows After Agent-to-Agent Privilege Escalation in Its Own Repository

The `google/adk-python` repository's CI/CD automation, specifically `gemini-review.yml`, `gemini-invoke.yml`, and `gemini-dispatch.yml`, plus the newer Antigravity-based `issue-analyze.yml` and `issue-fix.yml`

Pillar Security documented what it describes as the first practical case of agent-to-agent exploitation in a production multi-agent system. A public, low-privilege triage agent analyzed pull requests from external contributors and posted its replies through `adk-bot`, an account holding Collaborator access. Prompt injection hidden in a pull request, disguised as guideline-compliant triage steps, caused that low-privilege agent to post a comment containing an `@gemini-cli` mention. The dispatch workflow routed the mention to the high-privilege invoke workflow, which executed the attacker's prompt with elevated permissions, because the mention came from a Collaborator. Available to the resulting execution were a `GITHUB_TOKEN` scoped to `issues:write` and `pull-requests:write`, the `ADK_TRIAGE_AGENT` personal access token, a `GOOGLE_API_KEY`, and `ADK_GCP_SA_KEY`, a Google Cloud service account key with Vertex AI access; the researchers demonstrated exfiltrating the `adk-bot` token to an attacker-controlled server and using `GITHUB_TOKEN` to impersonate the bot and submit fake approvals. The Antigravity workflows fell to denylist bypasses in command validation, where `git` can execute arbitrary code through hooks or aliases. Google deleted three workflows, hardened the repository, and confirmed internal Copybara import and review steps would have blocked exploitation, but declined a financial award, saying the impact did not meet the bar because it required maintainer action and social engineering; the researchers received an Honorable Mention. No CVE was assigned

A trust boundary drawn around human identity rather than around content provenance. The high-privilege workflow's authorization check asked who posted the mention, not where the text originated, so a bot with Collaborator status became a laundering step that converted untrusted external input into a trusted internal command. Research by Pillar Security