Disclosed vulnerability
I'll just call you: a low-privileged CI agent on Google's adk-python is injected into summoning a high-privileged agent across a trust boundary
AIR-2026-0180 AIR record · 2026-08-google-adk-agent-to-agent-cicd
From the supporting source
The repository ran two classes of automated AI agents. The first class of low-privileged agents was embedded in workflows open to interaction, which were activated when a user opened a pull request or an issue.pillar.security
The record
Disclosed
2026-08-03
Vendor
Google
Product
google/adk-python (Agent Development Kit for Python) CI/CD agents
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation, Supply chain vulnerabilities, Confused deputy
System type
Generative model
Who acted
Agent acted — the low-privileged CI agent summoned the high-privileged agent, which executed
Attack surface
Multi-agent system
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection github issue or pr
Impact type
Credential theft, Supply chain compromise, Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Google ADK repository and its GCP service account resources
Capability abused
Defense & remediation
Recorded defense
separation of low- and high-privileged workflow agents; command allowlist validation
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
vulnerable workflows removed, repository hardened; fix confirmed 2026-07-21 (commit 66730e9)
Taxonomy & references
Curator notes
Pillar Security (Dan Lisichkin). Reported to Google VRP 2026-06-02 and 2026-06-05; fix confirmed 2026-07-21; published 2026-08-03. No CVE - the VRP panel reduced the reward citing social-engineering requirements. Exfiltrates ADK_TRIAGE_AGENT, GOOGLE_API_KEY and ADK_GCP_SA_KEY from the runner. Pillar's framing is the transferable part: 'The compromise lived in the _seams_, in one agent's ability to reach across a privilege boundary and set another in motion.' Compare 2025-09-cross-agent-privilege-escalation (Rehberger) on a developer workstation.
Supporting sources
Cite as
Enkrypt AI. "I'll just call you: a low-privileged CI agent on Google's adk-python is injected into summoning a high-privileged agent across a trust boundary". AIR, AIR-2026-0180. https://agentincident.vercel.app/i/AIR-2026-0180/ (accessed 2026-10-19).