Overview
- Pillar Security researchers discovered in early June that a public triage agent in the google/adk-python gemini-cli workflows could be prompt-injected to call a maintainer-only agent, creating a chain that elevated privileges between AI agents.
- Researcher Dan Lisichkin demonstrated the chain in a proof of concept that extracted the privileged agent’s available tools and showed how a token used by the maintainer-level job could be used to run commands and modify PRs, comments, labels, reviews, and approvals.
- Google removed three ADK workflows and applied hardening after the report and later fixed a separate remote-code-execution flaw in late July that did not require maintainer interaction.
- Pillar published the full technical report on August 3 and warned that agent-to-agent trust relationships in CI/CD can enable believable fake review trails and supply-chain poisoning if agent identities and token scopes are not tightly separated.
- Researchers recommend treating automated agents as distinct identities, narrowing token and tool scopes, and updating threat models and deployment practices to prevent untrusted issue or PR content from triggering privileged workflows.