Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent
Summary: Google deleted three AI agent workflows from its Agent Development Kit Python repository after Pillar Security showed a public GitHub issue could prompt-inject a triage agent into posting /adk-issue-fix as adk-bot, satisfying the privileged workflow's owner, member, or collaborator gate. The researchers demonstrated arbitrary code execution on the CI runner and exfiltration of the bot personal access token, and the privileged job also held a Google API key and a Google Cloud service-account credential.
Why it matters: The authorization check asked who posted the command, not whether an outsider had manipulated that trusted account, so a bot identity became the bridge into a job with write access to issues, contents, and pull requests plus cloud credentials. Pillar's proof-of-concept did not establish in-the-wild exploitation or a compromised ADK release, and the public record does not establish how far the exposed PAT and service-account credentials could reach.
Read the original at The Hacker News ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026