Google has recently taken down three AI workflows from its Agent Development Kit (ADK) Python repository following a security vulnerability that could be exploited via GitHub. The issue was highlighted by Pillar Security, which demonstrated how a public GitHub issue could force a triage agent to activate a privileged code-fixing agent.
Security Concerns with GitHub Workflow
Researchers discovered that a public agent could be prompt-injected to post a specific command as adk-bot. This maneuver exploited the bot’s status as a collaborator, satisfying the requirements of the privileged workflow’s access controls. Consequently, the trusted bot identity became a conduit for unauthorized actions.
The research team managed to demonstrate arbitrary code execution on a continuous integration (CI) runner, revealing the bot’s personal access token (PAT). Additionally, the privileged job held sensitive credentials, including a Google API key and a Google Cloud service-account credential. However, these researcher-led proof-of-concept attacks did not uncover any live exploitation or compromised releases of ADK.
Recommendations for Repository Security
Although the vulnerability was found in the repository automation rather than the ADK Python package itself, it prompted Pillar Security to advise similar projects to adopt separate bot identities, limit token and tool scopes, and implement authorization signals that are resilient against untrusted inputs.
The Hacker News reached out to Google regarding the bot token’s scopes and service-account permissions, as well as to Pillar Security about the proof-of-concept scenario and credential access. Both parties were yet to respond at the time of the report.
Details of the Vulnerability Exploit
The vulnerability originated from the public issue-analyze.yml workflow, which kicked in automatically upon the opening of any issue. It authenticated using ADK_GCP_SA_KEY and supplied necessary credentials to Google’s Antigravity coding agent. The agent then posted the analysis as a comment through the bot account.
A separate issue-fix.yml workflow triggered upon receiving /adk-issue-fix comments, restricting execution to trusted roles. However, it only verified the command’s poster, not whether a trusted account was manipulated.
The privileged job had write access to issues, repository contents, and pull requests, although these privileges were wrongly attributed to GitHub’s GITHUB_TOKEN instead of the PAT used by the job. Pillar Security noted that the PAT’s exact scopes were undisclosed. The script’s ability to enable CapabilitiesConfig() allowed the agent to write payloads and execute commands via custom hook paths.
Google’s Response and Future Implications
Google reacted by removing the workflows issue-analyze.yml, issue-fix.yml, and pr-analyze.yml, following a commit dated June 9, 2026. Pillar Security confirmed the absence of these workflows by July 2, with Google acknowledging the issue’s resolution by July 21. A subsequent check by The Hacker News on August 4, 2026, verified that these files were no longer present in the main branch’s workflow directory.
This incident underscores the importance of securing automated workflows and managing credentials with precision. As organizations increasingly rely on automation, ensuring robust security measures becomes crucial to prevent similar vulnerabilities.
