Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent
Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository after a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent.
Intelligence analysis by Llama
Google deleted three AI agent workflows from its ADK Python repository after a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent. The issue could have led to arbitrary code execution on the continuous integration (CI) runner and exfiltration of the bot personal access token (PAT).
Imagine you're working on a project and you need to fix some issues. You have a special tool that helps you do that, but it's not very good at following rules. If someone tricks the tool into doing something bad, it could let them do something very bad. Google fixed this problem by taking away the tool's special powers.
Analysis
A Critical Vulnerability Exposed in Google's ADK Repository
Google's Agent Development Kit (ADK) Python repository has been found vulnerable to a critical issue that could have allowed an attacker to manipulate a triage agent into triggering a privileged code-fixing agent. The issue was discovered by Pillar Security, a cybersecurity firm that specializes in identifying and mitigating vulnerabilities in software development pipelines.
The vulnerability was found in the ADK repository's automation workflows, which are designed to process untrusted issue and pull-request content. The workflows were found to be processing untrusted input with broad repository credentials, including a Google API key and a Google Cloud service-account credential. This allowed an attacker to potentially execute arbitrary code on the continuous integration (CI) runner and exfiltrate the bot personal access token (PAT).
The attack path began in the public issue-analyze.yml workflow, which ran automatically whenever an issue was opened. The workflow authenticated with ADK_GCP_SA_KEY, supplied ADK_TRIAGE_AGENT and GOOGLE_API_KEY to Google's Antigravity coding agent, and posted the generated analysis as a comment using the bot account. A separate issue-fix.yml workflow listened for /adk-issue-fix comments and restricted execution to an owner, member, or collaborator.
The privileged job declared write access to issues, repository contents, and pull requests. Those settings applied to GitHub's generated GITHUB_TOKEN, not the ADK_TRIAGE_AGENT PAT the job actually used. Pillar said the PAT's exact scopes were not public.
The job checked out the repository with the PAT, authenticated to Google Cloud, and ran the agent with the PAT and API key in its environment. The workflow was designed to edit code, create an adk-bot fork, push a branch, and open a pull request. A bot-generated pull request from June 4 shows that the automation was operating in the repository.
The runner rejected shell metacharacters and allowed only commands whose first token was gh or git. But the script enabled CapabilitiesConfig(), which Google's Antigravity SDK documentation says turns on all tools, including writes. The agent could therefore write a payload and make an allowed Git command execute it through a custom hook path.
Public artifacts do not establish whether the PAT could push directly to the main branch. Pillar said Google told it the service account had Vertex AI access in a dedicated GitHub-management project; broader permissions were not disclosed.
Pillar's report describes runner execution and credential exposure, but the public record does not establish the downstream repository or cloud reach of those credentials. The report also described an earlier chain that could create a false review trail through privileged Gemini workflows, but a maintainer still had to merge the pull request.
Google's removal commit says the workflows processed untrusted issue and pull-request content with broad repository credentials. Google deleted issue-analyze.yml, issue-fix.yml, and pr-analyze.yml in a patch whose metadata carries a June 9, 2026 author date. Pillar said it verified the workflows were absent on July 2 and that Google confirmed the issue fixed on July 21.
A check by The Hacker News on August 4, 2026, found none of the three filenames in the repository's current main-branch workflow directory.
Key points
- Google deleted three AI agent workflows from its ADK Python repository after a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent.
- The issue could have led to arbitrary code execution on the continuous integration (CI) runner and exfiltration of the bot personal access token (PAT).
- Pillar Security discovered the vulnerability and reported it to Google, which took swift action to remove the vulnerable workflows.
- The discovery highlights the importance of securing automation workflows and ensuring that untrusted input cannot manipulate privileged agents.
The discovery and removal of the vulnerable workflows demonstrate Google's commitment to security and its willingness to take swift action to mitigate potential vulnerabilities. This proactive approach will help prevent similar issues in the future and maintain the trust of users and developers.
The vulnerability highlights the importance of regularly reviewing and updating automation workflows to prevent potential security vulnerabilities. If left unaddressed, similar issues could lead to more severe consequences, including data breaches and unauthorized access to sensitive information.
