Executive Summary
Google deleted three AI agent workflows from its ADK Python repository after Pillar Security showed a public GitHub issue could prompt-inject a triage agent into posting a command as a collaborator bot, triggering a privileged code-fixing agent.
What Happened
Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security showed that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent. The researchers said the public agent could be prompt-injected into posting /adk-issue-fix as adk-bot. They identified the bot as a collaborator, so that comment satisfied
Affected Products
- Google Agent Development Kit (ADK)
Vulnerability / Attack Technique
Prompt injection chaining a public agent into a privileged one
Technical Mechanism
The triage agent read a malicious issue and posted '/adk-issue-fix' as adk-bot, a collaborator, which satisfied the check that launched the privileged fixing agent.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
A low-privilege agent's output became a high-privilege agent's trusted trigger. RealGround analysis: never let one agent's output authorize another agent's privileged action.
Recommended Controls
- Require human approval to trigger privileged agents
- Do not treat bot comments as authorization
- Separate identities for public-facing and privileged agents
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/08/google-deletes-3-adk-ai-workflows-after.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.