# Agent-to-Agent Privilege Boundary Failures in Google ADK for Python (adk-python) CI/CD Workflows via Cross-Agent Prompt Injection

> Pillar Security researchers Dan Lisichkin and Ariel Fogel demonstrated the first practical, real-world case of agent-to-agent exploitation in a production multi-agent system. Prompt injection targeting Google's ADK Python GitHub Actions CI/CD workflows enabled a low-privileged public-facing triage agent to cross privilege boundaries and trigger a high-privileged agent, leading to Remote Code Execution on CI runners, credential exfiltration (adk-bot PAT, GOOGLE_API_KEY, ADK_GCP_SA_KEY), and software supply chain compromise risk. Google remediated by deleting three vulnerable workflows (commit 66730e9). A separate code-injection vulnerability in the distributed google-adk Python package (CVE-2026-4810, CVSS 9.3) was also disclosed during the same window.

- **Published:** 2026-08-05T00:00:00Z
- **Last reviewed:** 2026-08-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1897
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-adk-python-triage-agent-injection-tl-2026-1897.webp?v=5a9d388c (Threadlinqs threat intel: CVE-2026-4810 Google ADK Agent Injection: Detection & IOCs (TL-2026-1897) — Critical severity, 18 IOCs, 9 detection rules.)
- **ID:** TL-2026-1897
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 18 (1 shown free below)
- **CVEs:** CVE-2026-4810

## Description

In mid-2026, Pillar Security researchers discovered and demonstrated the first practical, real-world case of agent-to-agent exploitation in a production multi-agent system, targeting the google/adk-python GitHub repository (Google's Agent Development Kit for Python). The repository ran two classes of automated AI agents at different privilege levels: low-privilege agents embedded in workflows open to public interaction (triggered when a user opened a pull request or issue) and high-privilege agents meant only for maintainers with real repository authority. The critical design flaw was that the adk-bot agent commented as a human Collaborator account bound to a long-lived Personal Access Token (PAT), giving it elevated trust in the authorization model.

The attack unfolded across two disclosed vectors. Attack Path 1 targeted the PR triage agent (adk_pr_triaging_agent), whose tools were limited to get_pull_request_details, add_label_to_pr, and add_comment_to_pr. An attacker could open a malicious pull request containing a prompt injection disguised as a PR summary. The triage agent, following the injected instructions, would post a comment starting with @gemini-cli, which triggered the maintainer-only gemini-dispatch.yml workflow. Because gemini-invoke.yml lacked a tools.core restriction, the attacker-controlled prompt had access to every bash command on the runner, enabling RCE and exfiltration of the GITHUB_TOKEN (scoped to issues:write and pull-requests:write). From there, the attacker could edit triager comments, submit approving PR reviews as github-actions[bot], dismiss review requests, and remove needs-review labels to fabricate a believable human-audited approval trail.

Attack Path 2 exploited a second wave of automation Google added after the initial disclosure: issue-analyze.yml (ungated, runs automatically on any external issue/PR) and issue-fix.yml (gated to only trigger when a collaborator comments /adk-issue-fix). An attacker prompt-injected a public GitHub issue so that issue-analyze.yml posted /adk-issue-fix as adk-bot, which was a collaborator. Since the authorization gate only checked who posted — not whether an outsider had manipulated the trusted account behind it — issue-fix.yml was triggered with elevated permissions. The Antigravity-SDK-based agent's run_command tool was restricted via _is_safe_command to only allow gh and git commands, but three bypasses existed: (1) git -c core.hooksPath=<dir> to run hook scripts from attacker-controlled directories; (2) git -c 'alias.x=!<cmd>' x to execute shell commands through git aliases; and (3) file-write tools were completely ungated, allowing the agent to write a malicious payload script and invoke it via allowlisted git commands. The fix workflow's environment included ADK_TRIAGE_AGENT (long-lived adk-bot PAT), GOOGLE_API_KEY, and ADK_GCP_SA_KEY (GCP service account key with Vertex AI access on a dedicated project), enabling full credential exfiltration on RCE.

Google confirmed both fixes: attack path 1 was hardened by July 9, 2026, and attack path 2 was fully remediated by July 21, 2026 (commit 66730e9) by deleting three workflow files (issue-analyze.yml, issue-fix.yml, pr-analyze.yml — 334 lines removed, zero additions). The VRP panel declined a financial reward for the first report, citing social-engineering requirements in the full exploit chain, but granted Honorable Mention. Separately, CVE-2026-4810 disclosed a code-injection vulnerability in the distributed google-adk Python package (versions 1.7.0 to 1.28.0, and 2.0.0a1) allowing unauthenticated RCE on the ADK server via malicious YAML configs with args keys uploaded through the builder UI (CWE-306, CVSS 4.0 score 9.3/Critical).

The root cause — compositional security failures where each component was defensible in isolation but risk lived in cross-agent privilege boundaries — represents a new class of attack surface. Pillar Security used their CFS (Critical Failure Surface) Framework to identify the chain. The key architectural lesson is that natural language has effectively joined the authorization path: an agent's authority extends beyond its assigned tools to any privileged system its output can reach, and when one agent's message can satisfy another agent's trigger gate, a privilege-boundary crossing exists that attackers can exploit.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1098 Account Manipulation
- T1548 Abuse Elevation Control Mechanism
- T1556 Modify Authentication Process
- T1036 Masquerading
- T1574 Hijack Execution Flow
- T1685 Disable or Modify Tools
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1550 Use Alternate Authentication Material
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1565 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GitHub Issue/PR Comment Contains AI Agent Trigger Phrase Indicating Prompt Injection** (`TL-2026-1897-SPL-001`)

Detects the initial exploitation vector in the google/adk-python cross-agent prompt injection attack: an attacker opens a malicious pull request or GitHub issue containing a prompt injection disguised as a PR summary or issue body. The low-privilege triage agent processes the untrusted content and, following the injected instructions, posts a comment starting with '@gemini-cli' — a trigger phrase that dispatches the maintainer-only gemini-dispatch.yml workflow. This detection monitors GitHub audit logs for automated account (adk-bot) comments matching known agent trigger patterns, indicating a successful prompt injection crossing the agent-to-agent privilege boundary.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1203, T1059
- **Data sources:** github_audit, github_actions_workflow_logs, github_webhook_events
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=github sourcetype="github:audit" action=created comment body=*@gemini-cli* OR body=*/review* OR body=*/adk-issue-fix* OR body=*ignore*previous*instructions* OR body=*forget*all*previous* OR body=*system*prompt* OR body=*you are now* OR body=*new role* (actor=adk-bot[bot] OR actor=github-actions[bot] OR actor=adk-bot) 
| eval trigger_type=case(
    match(body,"(?i)@gemini-cli"),"gemini-dispatch-trigger",
    match(body,"(?i)/adk-issue-fix"),"issue-fix-trigger",
    match(body,"(?i)/review"),"review-request-trigger",
    1=1,"prompt-injection-pattern"
  )
| eval suspicion_score=case(
    match(body,"(?i)(ignore|forget|disregard|override).*(previous|all|above|instruction|system)"),"high",
    match(body,"(?i)@gemini-cli"),"critical",
    match(body,"(?i)/adk-issue-fix"),"critical",
    1=1,"medium"
  )
| eval attack_path=case(
    match(body,"(?i)@gemini-cli"),"Attack Path 1: PR triage -> gemini-dispatch -> gemini-invoke RCE",
    match(body,"(?i)/adk-issue-fix"),"Attack Path 2: Issue analyze -> adk-bot collaborator -> issue-fix git bypass RCE",
    1=1,"Prompt injection probe"
  )
| where suspicion_score!="medium"
| convert ctime(_time)
| table _time repo actor action trigger_type suspicion_score attack_path body url
| sort - _time
```

### Microsoft KQL

```kql
GitHubAuditLogs
| where TimeGenerated > ago(24h)
| where Action == "commented" or Action == "created_comment"
| where CommentBody has_any ("@gemini-cli", "/adk-issue-fix", "/review", "ignore previous instructions", "forget all previous", "system prompt")
| where Actor in ("adk-bot[bot]", "github-actions[bot]", "adk-bot")
| extend TriggerType = case(
    CommentBody has "@gemini-cli", "gemini-dispatch-trigger",
    CommentBody has "/adk-issue-fix", "issue-fix-trigger",
    CommentBody has "/review", "review-request-trigger",
    "prompt-injection-pattern"
  )
| extend SuspicionScore = case(
    CommentBody matches regex @"(?i)(ignore|forget|disregard).*(previous|all|above|instruction|system)", "high",
    CommentBody has "@gemini-cli", "critical",
    CommentBody has "/adk-issue-fix", "critical",
    "medium"
  )
| where SuspicionScore in ("high", "critical")
| project TimeGenerated, Repository, Actor, Action, TriggerType, SuspicionScore, CommentBody, Url
| order by TimeGenerated desc
```

### Sigma

```yaml
title: GitHub Issue/PR Prompt Injection Targeting CI/CD AI Agent Workflows
id: 9a47b1c3-2d8e-4f6a-9b1c-7e3d5f8a2c4b
status: experimental
description: Detects GitHub issue and PR comments containing AI agent trigger phrases (@gemini-cli, /adk-issue-fix) or prompt injection keywords posted by automated bot accounts (adk-bot, github-actions[bot]). This indicates an attempted cross-agent privilege escalation where an attacker prompt-injects a low-privilege triage agent to trigger a high-privilege workflow, as documented in the google/adk-python agent-to-agent attack (Pillar Security, CVE-2026-4810).
references:
  - https://www.pillar.security/blog/ill-just-call-you-agent-to-agent-privilege-boundary-failures-in-ci-cd-on-googles-adk-repository
  - https://github.com/google/adk-python/commit/66730e9
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1203/
author: Threadlinqs Team
date: 2026/08/05
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1203
  - attack.t1059
  - cve.2026.4810
  - attack.tool.google_adk
logsource:
  product: github
  service: audit
  definition: GitHub Audit Logs from organizations using automated CI/CD agent workflows (ADK, LangChain, MCP, Antigravity SDK)
detection:
  selection_trigger_phrases:
    - body|contains|all:
        - '@gemini-cli'
    - body|contains|all:
        - '/adk-issue-fix'
    - body|contains|all:
        - '/review'
  selection_injection_keywords:
    - body|contains|all:
        - 'ignore'
        - 'instructions'
    - body|contains|all:
        - 'forget'
        - 'previous'
    - body|contains|all:
        - 'system'
        - 'prompt'
  selection_bot_actors:
    - actor|contains:
        - 'adk-bot'
        - 'github-actions[bot]'
  condition: selection_bot_actors and (selection_trigger_phrases or selection_injection_keywords)
falsepositives:
  - Legitimate maintainer-initiated @gemini-cli commands via authorized PR reviews
  - Triage bots in other repositories using similar trigger phrases
  - Automated CI/CD comment notifications from non-agent workflows
level: high
```

**Known false positives:**

- Legitimate maintainer-initiated @gemini-cli commands on authorized pull requests
- Bot accounts in other GitHub repositories using similar automated comment patterns
- Non-malicious /review commands posted by authorized code reviewers

**Tuning notes:** Tune by excluding comments from known trusted maintainer accounts or from repositories without ADK-style agent workflows. Consider creating an allowlist of expected automated comment patterns versus prompt-injection indicators. Set separate alert routing for critical-severity triggers (@gemini-cli, /adk-issue-fix) versus high-severity (generic injection keywords). Base thresholds on organizational GitHub audit volume to reduce noise.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Suspicious CI/CD Workflow Trigger Chain from Untrusted GitHub Issue/PR Content (locked: unlock with TL Creds)
- Credential Access via Environment Variable Exfiltration on CI/CD Runner Processes (locked: unlock with TL Creds)
- Lateral Movement via Stolen GitHub PAT Detected by Unusual Repository / PR Manipulation Activity (locked: unlock with TL Creds)
- Suspicious YAML Config Upload via ADK Builder UI Indicating CVE-2026-4810 Exploitation (locked: unlock with TL Creds)
- Ungated File Write to CI Runner Directory Followed by Git Hook Script Execution (locked: unlock with TL Creds)
- ADK Server C2 via Prompt-Injected Agent Tool Abuse and Authorization Bridge Exploitation (locked: unlock with TL Creds)
- Git Command Injection via core.hooksPath and Alias Bypasses on CI/CD Runners (locked: unlock with TL Creds)
- Credential Exfiltration from CI/CD Runner via Outbound HTTP with Sensitive Environment Data (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 18)

Defanged, TLP:CLEAR.

- URL: `hxxps://github[.]com/google/adk-python`

Full set of 18 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [I'll Just Call You: Agent-to-Agent Privilege Boundary Failures in CI/CD on Google's ADK Repository](https://www.pillar.security/blog/ill-just-call-you-agent-to-agent-privilege-boundary-failures-in-ci-cd-on-googles-adk-repository)
- [Google Deletes 3 ADK AI Workflows After Agent-to-Agent Privilege Escalation Attack](https://thehackernews.com/2026/08/google-deletes-3-adk-ai-workflows-after.html)
- [Google ADK flaws reveal what happens when AI agents trust the wrong message](https://www.infoworld.com/article/4204919/google-adk-flaws-reveal-what-happens-when-ai-agents-trust-the-wrong-message-2.html)
- [Google dev kit spurs first-ever agent-on-agent violence](https://www.theregister.com/security/2026/08/03/google-dev-kit-spurs-first-ever-agent-on-agent-violence/)
- [Fix: remove the issue/PR triage and fix agent workflows (commit 66730e9)](https://github.com/google/adk-python/commit/66730e9)
- [CVE-2026-4810 — Google ADK Python Code Injection / Missing Authentication](https://nvd.nist.gov/vuln/detail/cve-2026-4810)
- [CVE-2026-4810 GitHub Security Advisory (GHSA-rg7c-g689-fr3x)](https://osv.dev/vulnerability/GHSA-rg7c-g689-fr3x)
- [GitPython RCE via core.hooksPath Injection (GHSA-mv93-w799-cj2w)](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w)
- [CISA Vulnerability Summary for Week of July 27, 2026 (SB26-215)](https://www.cisa.gov/news-events/bulletins/sb26-215)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1897