GOOGLE has patched a pair of flaws in its open‑source Agent Development Kit for Python that allowed low‑privileged AI agents to leak secrets and tamper with pull requests, a risk uncovered by Pillar Security in June. The issues let an agent with limited rights invoke functions reserved for a higher‑privileged agent, effectively bypassing intended trust boundaries in CI/CD pipelines. Although no CVE identifiers were assigned, the vendor released fixes in July after responsible disclosure.
The core problem stemmed from prompt injection via GitHub pull request comments. A malicious actor could craft a comment that, when processed by the high‑privileged agent, would trigger the execution of arbitrary commands or expose environment variables intended only for trusted workflows. This chain effectively gave the low‑privileged agent the same capabilities as a maintainer, enabling secret leakage and unauthorized code changes.
Because the attack required the high‑privileged agent to ingest the malicious prompt, exploitation depended on some level of interaction from a trusted collaborator, which is why Google did not award a bug bounty for the initial findings. Nonetheless, researchers identified a second flaw within the same kit that permitted remote code execution without any user action, highlighting a broader weakness in how the SDK enforces agent segregation.
Pillar Security warned that the technique represents a novel supply‑chain vector, wherein AI‑driven agents could be weaponised to poison the pull‑request approval process or inject harmful dependencies into downstream projects. No active exploitation or threat‑actor adoption has been observed in the wild, but the method lowers the barrier for attackers seeking to manipulate trusted automation.
Organisations using the Agent Development Kit should immediately upgrade to the latest version, which contains the patches for both the privilege‑boundary bypass and the remote‑code‑execution issue. In addition, security teams ought to enforce strict input validation on any data fed to agents, treating pull‑request comments and similar artefacts as untrusted until verified.
Defenders are further advised to limit agent permissions to the least privilege necessary for their specific tasks, monitor pull‑request logs for unexpected command invocations, and consider sandboxing agent‑generated code before it reaches production branches. These steps can help close the trust gap that the flaws exposed and reduce the likelihood of similar abuse in future AI‑assisted development workflows.