Security researchers at Pillar Security say they have found what they describe as the first real-world example of one AI agent hijacking another, exploiting a flaw in Google's Agent Development Kit for Python (google/adk-python), an open-source toolkit with over 90 million downloads. The vulnerability allowed a low-privilege, public-facing agent that automatically triages pull requests to be manipulated via prompt injection into triggering a separate, high-privilege maintainer-only agent capable of executing malicious actions, highlighting new risks as AI agents are increasingly used in CI/CD workflows for code review and triage.

Researcher Dan Lisichkin found that an attacker could first submit a legitimate pull request mixing a real fix with malicious code, then open a second pull request containing a prompt injection that tricks the triage agent into issuing a trusted handoff to the privileged agent, effectively forging a convincing trail suggesting a human reviewed and approved the change when no such review took place. Google has since fixed the underlying issue but classed it as non-rewardable because it relied on social engineering; the company did not respond to requests for comment. Lisichkin is due to present the findings at DEF CON's AI Village on Friday 7 August and has urged security teams to start threat-modelling agent-to-agent attack scenarios.