Google dev kit spurs first-ever agent-on-agent violence

Google's Agent Development Kit for Python has been found to have a vulnerability that could allow for agent-on-agent exploitation, leading to supply chain compromise. A team of researchers discovered that an AI agent with lower privileges could be manipulated through prompt injection, triggering a high-privilege agent with the ability to execute malicious actions.

This issue arises from the way the repository runs two classes of automated AI agents with shared trust boundaries. The vulnerability stems from improper handling of prompt injections, which can be performed using English language commands or through AI assistance. To execute the attack, an external user would need to create a new pull request (PR) containing both legitimate fixes and malicious code.

The low-privilege agent, tied to a high-privilege collaborator's personal access token (PAT), would review the PR, allowing the attacker's code to trigger a gated workflow and execute the malicious action. Google has since fixed the underlying issue, but deemed the exploit non-rewardable due to its reliance on social engineering.

The researchers emphasize the need for security teams to consider agent isolation and identity, as well as resource access, in their threat models.