# Google dev kit spurs first-ever agent-on-agent violence

- URL: https://talkfuse.com/story/google-dev-kit-spurs-first-ever-agent-on-agent-violence/
- Published: 2026-08-03T20:30:37+00:00
- Updated: 2026-08-03T22:36:53+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/08/03/google-dev-kit-spurs-first-ever-agent-on-agent-violence/5282496
- Topics: Software

## Key points

- Researchers hijacked a privileged AI agent via a low-privilege one
- Flaw found in Google's widely used Agent Development Kit for Python
- Google patched it but called it non-rewardable, being social engineering

## Summary

Security researchers at Pillar Security say they have found what they describe as the first real-world example of one AI agent hijacking another, exploiting a flaw in Google's Agent Development Kit for Python (google/adk-python), an open-source toolkit with over 90 million downloads. The vulnerability allowed a low-privilege, public-facing agent that automatically triages pull requests to be manipulated via prompt injection into triggering a separate, high-privilege maintainer-only agent capable of executing malicious actions, highlighting new risks as AI agents are increasingly used in CI/CD workflows for code review and triage.

Researcher Dan Lisichkin found that an attacker could first submit a legitimate pull request mixing a real fix with malicious code, then open a second pull request containing a prompt injection that tricks the triage agent into issuing a trusted handoff to the privileged agent, effectively forging a convincing trail suggesting a human reviewed and approved the change when no such review took place. Google has since fixed the underlying issue but classed it as non-rewardable because it relied on social engineering; the company did not respond to requests for comment. Lisichkin is due to present the findings at DEF CON's AI Village on Friday 7 August and has urged security teams to start threat-modelling agent-to-agent attack scenarios.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.