Google dev kit spurs first-ever agent-on-agent violence

Google's Agent Development Kit (ADK) for Python has unveiled a new vulnerability that allows for agent-to-agent exploitation, potentially compromising supply chains. This discovery marks the first-ever real-world example of such an exploit. Researchers from Pillar Security uncovered the issue in the open-source Python toolkit behind Google's ADK, which boasts over 90 million downloads and is used to build and deploy AI agents.

The problem lies in the way the repository runs two classes of automated AI agents with differing privilege levels that inadvertently share a trust boundary. One agent is low-privileged and public-facing, while the other is high-privileged and accessible only to maintainers. Pillar's Dan Lisichkin found that the low-privileged agent could be manipulated through prompt injection, triggering the higher-privileged agent to execute malicious actions.

To execute this attack, an external user would need to create a new pull request (PR) containing both legitimate code and malicious elements. The public-facing agent, tied to a high-privileged collaborator's personal access token, would read the PR and mark it for review. This would enable the malicious code to trigger a gated workflow, ultimately allowing the attacker to execute their malicious action within the privileged agent's workflow.

Google has since patched the underlying issue, but deemed the exploit non-rewardable due to its reliance on social engineering. Nonetheless, Lisichkin emphasizes that the findings highlight the risks of using AI agents in CI/CD workflows for tasks like triage, pull request reviews, and discussions. He advises security professionals to begin threat modeling these scenarios and understanding the potential blast radius.