Pillar Security has identified a critical vulnerability in Google’s Agent Development Kit for Python, which could potentially expose sensitive information and allow for tampering with pull requests. This discovery highlights significant security risks within the system.
Agent-to-Agent Attack Details
The vulnerability resides in the google/adk-python repository, where two types of automated AI agents exist. The low-privileged agents are accessible to users, whereas high-privileged agents are restricted to maintainers. Attackers could exploit the low-privileged agents to relay commands to the high-privileged ones, thereby gaining unauthorized access to execute commands and potentially compromise the supply chain, as explained by Dan Lisichkin from Pillar Security.
Exploitation and Consequences
Initially, it was observed that a triaging agent with high repository privileges could comment on pull requests as a Collaborator. Lisichkin devised a method to manipulate this agent to post comments that triggered privileged workflows, revealing the tools accessible to the high-privileged agent via the MCP server. This exposure allowed for remote code execution and unauthorized access to the agent’s GitHub token, enabling further manipulation of repository elements such as comments, issues, and pull requests.
Required Social Engineering and Google’s Response
Despite the potential for PR manipulation, any malicious pull request required approval and merging by a member, necessitating social engineering tactics. While Google was informed of this vulnerability in June, the company did not award a bug bounty due to the reliance on social engineering. However, Google did address the issue by strengthening security measures.
Further investigations by Pillar Security uncovered another flaw in the ADK repository’s automation features, specifically within the Antigravity-SDK-based agent. This vulnerability potentially enabled remote code execution without maintainer interaction, which Google promptly resolved by late July.
The discovery of these vulnerabilities underscores the ongoing need for robust security measures in automated systems, particularly those involving AI agents with varying privilege levels. Organizations must remain vigilant to prevent exploitation and ensure the integrity of their software development processes.
