Pillar Security discovered an agent-to-agent attack method in Google's ADK for Python where a low-privileged, user-facing agent could be manipulated to send malicious prompts to a high-privileged agent. This allowed attackers to execute commands remotely, extract GitHub tokens, and impersonate maintainers by modifying pull request comments, approvals, and reviews. The attack chain included posting crafted comments that triggered privileged workflows, leaking access to bash commands and enabling remote code execution. Although the attack required social engineering to merge malicious pull requests, it posed a risk of supply chain compromise. Google was notified and implemented hardening measures in early June. Subsequently, another vulnerability in the ADK's automation features was found and fixed in late July, which could have allowed remote code execution without maintainer interaction.

The vulnerability exposed secrets such as GitHub tokens and allowed remote code execution via a privileged agent. Attackers could impersonate maintainers by modifying pull request comments, dismissing or approving reviews, and manipulating the pull request approval lifecycle. This could enable supply chain compromise through malicious pull requests. However, merging malicious code required social engineering to gain collaborator trust and approval from maintainers. The second vulnerability fixed later allowed remote code execution without maintainer interaction, increasing risk.

Google has addressed the vulnerabilities through hardening and fixes implemented by late July 2026. No further action is required from users as the issues have been remediated. Organizations using the Google ADK for Python should ensure they are using the updated, patched versions. Patch status is not explicitly confirmed; users should verify with Google's official advisories for current remediation guidance.