Overview
- Security firm Pillar Security published proof‑of‑concept research in early August showing a chain where an untrusted GitHub issue or PR could prompt‑inject a low‑privilege gemini-cli agent to trigger a higher‑privilege maintainer agent.
- That chain let researchers demonstrate exfiltration of credentials such as bot tokens and the ability to run arbitrary shell commands on continuous integration runners by abusing workflow file writes and Git hooks.
- Google removed three vulnerable ADK workflows from the google/adk-python repository and applied hardening patches after Pillar notified it in June, and Google confirmed fixes for a second Antigravity‑SDK flaw in late July.
- No evidence of in‑the‑wild exploitation has been reported, but Google declined a bug bounty on the ground that an attacker would still need social engineering to get a malicious PR merged.
- Pillar and reporters warn this exposes a new class of supply‑chain risk for widely used automation — gemini‑cli has tens of millions of downloads — and they recommend separate agent identities, least‑privilege tokens, and authorization checks that cannot be forged by untrusted text.