Researchers expose agent-to-agent exploit in Google's AI development kit

A team at Pillar Security identified a novel agent-to-agent attack vector in Google's Agent Development Kit for Python, a widely used open-source library for building AI agents. The exploit leverages prompt injection in a low-privilege, public-facing bot that can activate a high-privilege maintainer bot, enabling malicious code to be introduced into pull requests and potentially steal GitHub tokens. The researchers demonstrated how an attacker could combine a legitimate fix with hidden payloads across two sequential pull requests to fabricate a trusted review trail.

Google has since corrected the code but classified the report as non-rewardable because it required social engineering. The incident underscores the need for explicit agent identities and stricter threat modeling in automated development workflows. Dan Lisichkin will present the research at DEF CON's AI Village on August 7.