Ethical Hacking News
Google's Agent Development Kit has been exploited by attackers to compromise supply chains, highlighting the risks of using AI agents in CI/CD workflows and the importance of robust security measures.
The discovery of an exploit in Google's Agent Development Kit for Python allows attackers to compromise supply chains by exploiting agent-on-agent violence. The vulnerability lies in the repository behind Google's Agent Development Kit, which has been used to build and deploy AI agents over 90 million times. The exploit takes advantage of a trust boundary between two classes of automated AI agents: one with low privileges and another with high privileges. External users can create malicious pull requests that trigger the high-privilege agent, allowing them to execute malicious actions. The lack of agent isolation and identity mechanisms for each agent allowed attackers to manipulate the low-privilege agent into triggering the high-privilege agent. The exploit highlights the need for organizations to prioritize agent isolation and identity mechanisms in AI-powered systems.
In the rapidly evolving landscape of artificial intelligence (AI), a new and sinister form of exploitation has emerged, leaving security experts and researchers alike to question the very fabric of AI-driven systems. The discovery of an exploit in Google's Agent Development Kit for Python, which enables attackers to compromise supply chains by exploiting agent-on-agent violence, serves as a stark reminder of the dangers that lurk in the uncharted territory of AI-powered systems.
According to Pillar Security researchers, the vulnerability lies in the repository behind Google's Agent Development Kit, which contains over 90 million downloads and has been used to build and deploy AI agents. The exploit takes advantage of a trust boundary between two classes of automated AI agents: one with low privileges and another with high privileges. The low-privilege agent, activated whenever a user opens a pull request or issue, can be manipulated via prompt injection to trigger the high-privilege agent, which can execute malicious actions.
The attack vector is straightforward: an external user creates a new pull request, combines a real fix with malicious code, and marks it for review. The public-facing agent, tied to a high-privilege collaborator's personal access token (PAT), reads the attacker's PR text and triggers a gated workflow, allowing the attacker to control the privileged-agent workflow and execute malicious actions.
The research team, led by Dan Lisichkin, discovered that the exploit stems from the way Google's Agent Development Kit ran two classes of automated AI agents with different privilege levels. The lack of agent isolation and the absence of a robust identity mechanism for each agent allowed the attacker to manipulate the low-privilege agent into triggering the high-privilege agent.
"The world is changing quickly, and new attack surfaces are not yet reflected in threat models because these attacks never could exist in the first place in the 'pre-agent' world," Lisichkin said. "CISOs and security practitioners should start considering these scenarios, threat-modeling them, and calculating worst-case implications and blast radius."
The discovery of this exploit has significant implications for organizations that rely on AI-powered systems for various tasks, including supply chain management, data analysis, and more. The fact that the exploit can be triggered via prompt injection, which requires minimal technical expertise, makes it a serious concern.
Google's response to the vulnerability has been to fix the underlying issue in the repository, but deemed the exploit non-rewardable because it involved social engineering. While this may seem like a minor setback, the research team emphasizes that agent isolation is not enough to prevent such attacks.
"Agents should have their own identity, which mandates what resources they are allowed to access and in what they are allowed to interact with these resources," Lisichkin said. "In this case, if Google had just given a bot identity to the initial triaging agent, most of the attack could have been prevented."
As AI continues to permeate various aspects of our lives, it is essential that security experts and researchers remain vigilant in identifying and addressing vulnerabilities in AI-powered systems. The discovery of this exploit serves as a stark reminder of the importance of robust security measures and the need for organizations to prioritize agent isolation and identity mechanisms.
In conclusion, the exploitation of Google's Agent Development Kit highlights the risks associated with using AI agents in CI/CD workflows for tasks such as triage, pull request reviews, and discussions. The discovery underscores the need for organizations to reassess their approach to AI security and invest in robust measures to prevent similar attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Dark-Side-of-Artificial-Intelligence-A-Glimpse-into-the-Uncharted-Territory-of-Agent-on-Agent-Violence-ehn.shtml
https://www.theregister.com/security/2026/08/03/google-dev-kit-spurs-first-ever-agent-on-agent-violence/5282496
Published: Mon Aug 3 16:24:47 2026 by llama3.2 3B Q4_K_M
