Google dev kit spurs first-ever agent-on-agent violence
Security researchers at Pillar Security say they have found what they describe as the first real-world example of one AI agent hijacking another, exploiting a flaw in Google's Agent Development Kit for Python (google/adk-python), an open-source toolkit with over 90 million downloads. The vulnerability allowed a low-privilege, public-facing agent that automatically triages pull requests to be manipulated via prompt injection into triggering a separate, high-privilege maintainer-only agent capable of executing malicious actions, highlighting new risks as AI agents are increasingly used in CI/CD workflows for code review and triage.
Researcher Dan Lisichkin found that an attacker could first submit a legitimate pull request mixing a real fix with malicious code, then open a second pull request containing a prompt injection that tricks the triage agent into issuing a trusted handoff to the privileged agent, effectively forging a convincing trail suggesting a human reviewed and approved the change when no such review took place. Google has since fixed the underlying issue but classed it as non-rewardable because it relied on social engineering; the company did not respond to requests for comment. Lisichkin is due to present the findings at DEF CON's AI Village on Friday 7 August and has urged security teams to start threat-modelling agent-to-agent attack scenarios.
In short
- Researchers hijacked a privileged AI agent via a low-privilege one
- Flaw found in Google's widely used Agent Development Kit for Python
- Google patched it but called it non-rewardable, being social engineering
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The vulnerability demonstrates a novel attack surface created by deploying autonomous agents in software development pipelines. The fact that one agent could be tricked into delegating to another with higher privileges represents a qualitatively different risk from traditional security vulnerabilities, requiring new defensive strategies specifically designed for agent-to-agent interactions. As AI agents become more integrated into critical infrastructure like code review and deployment, organisations should proactively develop threat models and safeguards specifically tailored to prevent such delegations of authority, because the attack surface is genuinely expanding.
The case against
Whilst the implementation involves AI agents, the underlying vulnerability is a well-established class of attacks: a low-privileged user performing social engineering via prompt injection to trick a higher-privileged system into executing their will—precisely the same threat model as traditional privilege escalation and social engineering attacks. Classifying this as a new category of threat risks diverting security resources toward AI-specific mitigations when the fundamental issue is that any system allowing unsanitised user input to influence privilege-based decisions is vulnerable. The vulnerability was appropriately fixed through standard input validation; no novel security paradigm is required.
Explained simply
AI agents are software systems that can carry out tasks with limited human input. In software projects, they may review code, sort incoming changes or help maintainers manage updates, and some can take actions such as running commands.
Google’s Agent Development Kit for Python is an open-source toolkit for building these systems. In the reported case, one agent handled public pull requests—proposed changes to a project’s code—while a separate agent had greater privileges to perform actions for maintainers.
The concern is that instructions hidden in a submission could influence a public-facing agent and lead it to pass work to a more powerful agent. This matters because software teams are increasingly using agents in development workflows, where an action taken without the intended human review could affect code or systems.