Google ADK for Python RCE: Agent-to-Agent Attacks Expose Secrets

Pillar Security researchers have identified critical agent-to-agent attack methods within Google’s Agent Development Kit for Python (google/adk-python), which could lead to remote code execution (RCE), secret exposure, and extensive pull request (PR) tampering. These findings underscore significant risks to software supply chain integrity, particularly in environments leveraging automated AI agents for development workflows, according to SecurityWeek.

Overview of Agent-to-Agent Vulnerabilities

The research by Pillar Security, led by Dan Lisichkin, revealed two distinct classes of vulnerabilities impacting the google/adk-python repository. The core issue revolves around the interaction between low-privileged, user-facing AI agents and high-privileged agents typically reserved for maintainers. By manipulating the less-privileged agent, an attacker could escalate access and execute arbitrary commands.

Initial Discovery: Manipulating Gemini Agents for RCE and PR Tampering

The initial vulnerability centered on an agent responsible for triaging pull requests within the google/adk-python repository. This agent, possessing collaborator-level privileges, could be manipulated by an attacker. The attack scenario involved an attacker crafting a PR comment containing an @gemini-cli <prompt> command. This comment would trigger the gemini-invoke workflow, which, unbeknownst to the developers, provided access to a more privileged execution environment.

Upon triggering, the gemini_invoke.yml workflow inadvertently leaked the tools accessible to the privileged agent via the MCP server. This critical disclosure revealed that the bot had access to every bash command. This discovery immediately opened the door to remote code execution, allowing the researcher to potentially extract the agent’s GitHub token. With this elevated access, an attacker could:

• Modify comments, pull requests, and issues associated with other maintainers, collaborators, and members.
• Dismiss legitimate reviews or approve malicious pull request changes.
• Invoke gemini-invoke and gemini-review against any PR, effectively subverting the review process.

While the ultimate merging of a malicious PR would still require social engineering—convincing a human maintainer to approve it—the ability to tamper with review trails and manufacturing a complete, believable approval path significantly elevates the risk of supply chain compromise. Lisichkin noted that this could create a fabricated history where “a human asked for a review, Gemini ran it, Gemini approved” even when no human interaction or legitimate review occurred.

Google was informed of these findings in early June 2024 and subsequently addressed the issues through system hardening measures. However, the company did not deem the exploit worthy of a bug bounty, primarily due to the social engineering prerequisite for final malicious PR merge.

Subsequent Antigravity-SDK RCE

Shortly after the initial disclosure, Pillar Security identified a second, arguably more severe, vulnerability within the same ADK repository. This flaw resided in the automation features of an Antigravity-SDK-based agent. Crucially, this weakness allowed for remote code execution without requiring any direct maintainer interaction, presenting a more immediate and potent threat vector. Google swiftly fixed this vulnerability in late July 2024.

Implications for Software Supply Chain Security

These vulnerabilities highlight the evolving attack surface within modern software development, where automated agents and CI/CD pipelines are increasingly targeted. An agent-to-agent attack, like those found in google/adk-python, can bypass traditional security controls by leveraging trusted internal communication channels and elevated privileges granted to automation tools. This can lead to the silent introduction of malicious code, backdoors, or logic bombs into repositories, severely compromising the integrity of the software supply chain.

Organizations using similar agent-driven automation in their development workflows must understand how to detect Google ADK for Python agent-to-agent attacks and apply similar scrutiny to their own systems. The ability to manipulate review processes and execute arbitrary code represents a significant risk for intellectual property theft, data exfiltration, and downstream compromise of applications built from affected repositories.

Mitigating Google ADK for Python Agent-to-Agent Attacks

Defenders must prioritize several key actions to address these types of agent-based vulnerabilities and secure Google ADK for Python Antigravity-SDK RCE scenarios:

• Immediate Patching: Ensure all instances of google/adk-python are updated to the latest versions that include Google’s hardening measures and security fixes from June and July 2024. This is the most critical immediate step.
• Principle of Least Privilege: Strictly enforce the principle of least privilege for all automated agents, bots, and CI/CD pipelines. Agents should only possess the minimum necessary permissions required to perform their designated tasks. Regularly audit these permissions.
• Input Validation and Sanitization: Implement rigorous input validation and sanitization for all data processed by automated agents, especially those interacting with user-supplied content (e.g., PR comments). Prevent the injection of malicious commands or unexpected prompts.
• Enhanced Monitoring and Auditing: Establish comprehensive logging and monitoring for agent activities, command executions, and any modifications to pull requests, issues, or repository settings. Look for anomalous behavior, such as agents approving their own PRs or executing commands outside their typical scope. Implement alerting for suspicious activities.
• Multi-Factor Approval for Sensitive Actions: For critical actions like merging code, dismissing reviews, or modifying repository settings, mandate multi-factor human approval, even if an agent has provided an initial “approval.” This helps mitigate pull request tampering vulnerabilities even if an agent is compromised.
• Secure Software Development Lifecycle (SSDLC): Integrate security considerations into the design and deployment of AI agents and automation. Conduct regular security assessments, penetration testing, and code reviews of agent logic and interactions to proactively identify and rectify similar vulnerabilities.

Related: TeamPCP Campaign Update: Mini Shai-Hulud Framework Gains Adoption, OptinMonster 2.6.5 Update: Managing CDN Supply Chain Attack Risks