First Real-World Agent-to-Agent Attack: How a Prompt Injection in Google's ADK Enabled Supply Chain Compromise

How the Agent-to-Agent Attack Worked

The google/adk-python GitHub repository contained two classes of automated AI agents with different privilege levels :

• A low-privileged, public-facing triage agent that could interact with anyone submitting a GitHub issue.
• A high-privileged code-fixing agent (/adk-issue-fix) that had write access to the repository and could modify pull requests.

The exploitation chain unfolded as follows:

1. An attacker submitted a malicious GitHub issue containing a prompt injection disguised as a legitimate bug report .
2. The low-privileged triage agent processed the issue and was tricked by the injected prompt into calling the high-privileged code-fixing agent by posting the /adk-issue-fix command .
3. The privileged agent then executed the attacker's malicious instructions, which could include extracting the GITHUB_TOKEN (exposing sensitive credentials) and tampering with pull request reviews—effectively poisoning the software supply chain .

The researchers described this as an "agent-to-agent privilege boundary failure" — the low-privilege agent could cross a trust boundary and invoke a high-privilege workflow it should not have been able to call . According to The Hacker News, the researchers demonstrated arbitrary code execution on the continuous integration infrastructure, with the adk-bot account—identified as a collaborator—serving as the authorization bridge .

Google's Response

After Pillar Security disclosed the vulnerabilities, Google took the following actions:

• Deleted three AI agent workflows from the ADK Python repository that were involved in the exploit chain .
• Corrected the issues to prevent the privilege escalation path .

Google did not dispute the findings and moved swiftly to remove the vulnerable automation .

Broader Security Concerns for Agentic Systems

The incident highlighted several systemic risks that extend far beyond Google's ADK:

Agent-to-agent trust boundaries are fundamentally weak. When one agent can invoke another with higher privileges, prompt injection in the lower-privilege agent becomes a supply chain attack vector . The low-privileged, internet-exposed agent could be manipulated through prompt injection to reach across this boundary and invoke the high-privileged agent on its behalf .

Prompt injection is a systemic framework flaw, not just a model flaw. Check Point research published concurrently found nearly a dozen critical flaws in major AI agent frameworks, concluding that "prompt-controlled content can manipulate agent behavior in ways that bypass intended security controls" . The researchers spent a year analyzing agent frameworks and found that in many cases, prompt-controlled content could cross the boundary into trusted framework logic itself .

The attack class is novel and unpatchable by models alone. Even if individual LLMs are secured against prompt injection, the architectural design of multi-agent systems—where agents implicitly trust messages from other agents—creates new attack surfaces that require framework-level security controls .

Default permission scoping in agent frameworks is often too permissive. Without strict least-privilege boundaries between agents, similar exploits are likely in other platforms. Palo Alto Networks research published earlier in 2026 found that default permission scoping in Google Cloud's Vertex AI could allow a compromised agent to achieve privileged access to data and infrastructure .

Implications for AI Security

As organizations increasingly deploy multi-agent systems for code review, CI/CD, and internal automation, the ADK incident serves as a critical warning. The attack demonstrates that agentic AI introduces new attack surfaces that require security controls at the architecture and framework level—not just at the model or prompt level. Teams building agentic systems should implement strict privilege boundaries, validate inter-agent communication, and treat prompt injection as a framework vulnerability rather than a model quirk.