Google has deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository after security researchers at Pillar Security demonstrated that a public GitHub issue could trick a triage agent into triggering a privileged code-fixing agent. The episode, which researchers described as the first agent-on-agent incident of its kind, shows how a poisoned issue tracker can turn an AI agent’s own autonomy into a vulnerability.
How a Public GitHub Issue Prompt-Injected the ADK Triage Agent
Pillar Security showed that a crafted GitHub issue could influence the public triage agent into posting the command /adk-issue-fix as adk-bot, the automated account that processes issues in the repository. The researchers identified that the bot held collaborator permissions on the repository, so the triage agent’s comment satisfied the trigger condition and set off the privileged code-fixing agent without a human approving the change.
The Trigger Chain That Activated a Privileged Code-Fixing Agent
The attack relied on the way the ADK workflows chain agents together. A malicious or manipulated issue served as the entry point, the triage agent accepted the prompt-injected content and issued the trigger command under the adk-bot identity, and that action handed control to an agent with the authority to modify code. Because each step looked like normal agent behavior, the chain could proceed without an obvious authorization checkpoint.
Why the ADK Episode Signals a New Class of Agent Risk
Agent-driven development tooling introduces a new attack surface because the agents act on the content they consume from issue trackers, chat channels, and repositories, and that content is often user- or attacker-controllable. In this case, a public GitHub issue — the very thing a developer repository exists to accept — was sufficient to steer an agent into privileged action. The research demonstrates that prompt injection is no longer confined to a single query response; it can now induct an autonomous agent into performing an operation.
The Privilege-Escalation Surface in Agent-Driven Development
The severity comes from combining an untrusted input channel with an agent that holds elevated permissions. When a triage agent carries collaborator-level authority and can trigger a code-fixing agent, the gap between “comment posted” and “code changed” collapses, and the authorization boundary that normally protects a repository moves into the agent logic where it is harder for humans to enforce. Pillar Security identified the adk-bot identity as a repository collaborator, which meant the trigger comment carried the authority the privileged agent trusted.
Responding to Prompt Injection in Agent Tooling
Google removed the affected workflows from the ADK repository, and Pillar Security published the research so other teams building agent-driven pipelines can learn from the incident. For organizations adopting agent-based development, the episode points to a need for explicit trust boundaries: agents should not hold permissions they can use based purely on the content they parse, and privileged actions should require confirmation that cannot be satisfied by a prompt-injected command.
The “Agent-on-Agent Violence” Framing and Its Limits
The incident has been described as the first agent-on-agent episode of its kind, a framing that captures the novelty of one automated system acting against another. The value of that framing is that it focuses attention on the new dynamics agents introduce — autonomous systems holding credentials and permissions that react to attacker-influenced input — while the underlying mechanics remain recognizable as classic prompt injection and privilege chaining.
The broader implication is that AI agents will increasingly sit at decision points in software development, and the techniques used to compromise them — content injection, privilege chaining, and identity spoofing — mirror the fundamentals of traditional web security but with the attacker’s payload arriving as trusted-looking natural language. The Google ADK removal is an early acknowledgment that this problem is real and that the engineering response is still being written.
For security teams building or adopting agent frameworks, the practical read is that agent permissions and the content agents consume must be treated with the same rigor as any other privileged code path. Until agent frameworks build in intrinsic safeguards against prompt-injected privilege escalation, the onus is on the organization to place guardrails around what an agent is allowed to do in response to the messages it receives.
