The discovery of a significant vulnerability in a GitHub repository has revealed how AI agents can be manipulated to compromise software supply chains. This situation represents a new type of attack where one AI agent is exploited to undermine another, posing a major risk to the security of automated systems.
The issue was identified in the google/adk-python repository, which supports the development of AI agents using Google’s Agent Development Kit for Python. This kit is widely utilized by developers, making the vulnerability particularly concerning.
Understanding the AI Agent Vulnerability
The adk-python repository employs two levels of AI agents: a low-privileged agent for public interactions and a high-privileged agent for trusted users. Researchers from Pillar Security found that the low-privileged agent could be manipulated through prompt injection to activate the high-privileged agent, leading to potential security breaches.
This exploitation began with the adk_pr_triaging_agent, which was linked to a human-like collaborator account. By crafting a deceptive pull request comment, the researchers were able to trigger the high-privileged workflows, exploiting the trust GitHub places in collaborator accounts.
Implications of the Exploited Vulnerability
Once the high-privileged workflows were activated, the researchers accessed a GitHub token that, despite its limited permissions, allowed them to edit comments, impersonate maintainers, and simulate code reviews. This chain of actions enabled the creation of a false approval trail for malicious code without actual human oversight.
Following these revelations, Google introduced new automation to the repository, which inadvertently introduced another vulnerability. This involved bypassing command restrictions using git’s scripting capabilities, permitting remote code execution on the CI runner.
Security Enhancements and Future Considerations
In response to the findings, Google reinforced the security of the adk-python repository. However, since the exploitation relied on social engineering, it was not eligible for a reward. Pillar Security received recognition for their disclosure.
The incident highlights the need for security teams to adapt to the evolving threat landscape of AI-driven workflows. Experts suggest that AI agents with access to sensitive information should have narrowly defined identities and adhere to strict security practices to prevent exploitation.
To protect against such threats, it is crucial to implement thorough review processes, enforce tool allowlists, and maintain human oversight in automated systems. These measures can mitigate the risk of a single compromised agent leading to widespread security breaches across the supply chain.
