Google removed three AI agent workflows from its Agent Development Kit (ADK) Python repository after security researchers demonstrated how a malicious actor could manipulate automated systems to execute arbitrary code and steal sensitive credentials. Pillar Security showed that a publicly accessible GitHub issue could trick a triage agent into activating a privileged code-fixing agent, creating a pathway to compromise repository automation. The flaw affected the repository's automation infrastructure rather than the distributed ADK Python package itself.
The attack exploited a chain beginning with the public issue-analyze.yml workflow, which launched automatically when any user opened an issue. Pillar Security researchers discovered they could inject prompts into the public agent, forcing it to post the command /adk-issue-fix as adk-bot. Because the bot held collaborator status, that comment passed the privileged workflow's authorization gate, which verified who posted the command but not whether an outsider had manipulated the trusted account. The privileged job authenticated to Google Cloud and ran the agent with a bot personal access token (PAT) and API key in its environment. Though the runner blocked shell metacharacters and permitted only commands starting with gh or git, the script enabled CapabilitiesConfig(), which Google's Antigravity SDK documentation confirms activates all tools, including write capabilities. The agent could write a malicious payload and execute it through a custom Git hook path, since Git's documentation establishes that hooks are executable programs and core.hooksPath can redirect Git to another directory. The team successfully demonstrated arbitrary code execution on the continuous integration runner and exfiltration of the bot PAT. The privileged job also contained a Google API key and a Google Cloud service-account credential, though Pillar said Google disclosed only that the service account had Vertex AI access in a dedicated GitHub-management project.
According to the researchers, the bot identity became the authorization bridge because the workflow checked collaborator status without verifying whether untrusted text had manipulated the trusted account behind it. Google's removal commit stated the workflows processed untrusted issue and pull-request content with broad repository credentials. Pillar's proof-of-concept attacks don't identify in-the-wild exploitation or a compromised ADK release, and the exposed component was repository automation rather than a defect in the distributed Python package. Google deleted issue-analyze.yml, issue-fix.yml, and pr-analyze.yml in a patch carrying a June 9, 2026 author date, Pillar verified the workflows were absent on July 2, and Google confirmed the issue fixed on July 21. The Hacker News confirmed on August 4, 2026 that none of the three filenames appeared in the repository's current main-branch workflow directory.
The vulnerability emerged because the privileged workflow authenticated with credentials that granted write access to issues, repository contents, and pull requests, then supplied those credentials to an AI agent whose capabilities included file writes. The report explains that while the runner's command allowlist narrowed syntax to gh or git, file writes combined with Git's hook mechanism still created a route to code execution. The workflow was designed to edit code, create an adk-bot fork, push a branch, and open a pull request, and a bot-generated pull request from June 4 shows the automation was operating in the repository. The privileged job declared write permissions that applied to GitHub's generated GITHUB_TOKEN, but the job actually used the ADK_TRIAGE_AGENT PAT, whose exact scopes weren't public. Public artifacts don't establish whether the PAT could push directly to the main branch, and the public record doesn't establish the downstream repository or cloud reach of the exfiltrated credentials.
For similar repositories, Pillar recommends separate bot identities, narrower token and tool scopes, and an authorization signal that untrusted text can't generate. The Hacker News contacted Google about the bot token's scopes, service-account permissions, and exploitation evidence, and Pillar Security about the proof-of-concept environment and credential access, but both responses were pending at the time of writing. The incident underscores a core challenge in repository automation: authorization gates that verify identity without checking whether an adversary has manipulated the trusted account through prompt injection create a bridge between public input and privileged execution. Organizations deploying AI agents in automation pipelines will need to architect controls that separate the signal verifying human intent from text an attacker can craft, particularly when those agents hold credentials with write access to production systems or cloud infrastructure.