Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent

Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security showed that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent. The researchers said the public agent could be prompt-injected into posting /adk-issue-fix as adk-bot. They identified the bot as a collaborator, so that comment satisfied

According to The Hacker News and Pillar Security, researchers showed that a public, low-privilege GitHub issue in Google's ADK Python repository could prompt-inject a triage agent into posting a maintainer-only trigger comment (/adk-issue-fix) as the trusted adk-bot account, thereby activating a privileged code-fixing workflow and enabling CI runner code execution and bot PAT exfiltration.[1][3][4] Google responded by deleting three vulnerable workflows (issue-analyze.yml, issue-fix.yml, pr-analyze.yml) that processed untrusted issue and PR content with broad repository credentials.[1][3] From a RealGround perspective, this is a textbook *indirect prompt injection* and agent-to-agent privilege escalation in CI/CD, showing how seemingly benign public text can coerce one AI agent to call higher-privileged tools and workflows. Practically, orgs should re-architect multi-agent GitHub/CI integrations so that public-facing agents have minimal scopes, cannot directly trigger maintainer workflows, and are continuously red-teamed for cross-agent privilege boundary failures.