{"slug": "google-adk-agent-to-agent-attack-privilege-boundary-breakdown-calling-privileged", "title": "Google ADK Agent-to-Agent Attack: Privilege Boundary Breakdown Calling Privileged CI Workflows from Low-Privilege Triage Agents", "summary": "Pillar Security researchers demonstrated an agent-to-agent privilege boundary failure in Google's Agent Development Kit (ADK) repository, where a low-privilege triage agent could be manipulated via prompt injection to trigger privileged CI/CD workflows, leading to runner RCE and spoofing of the PR approval lifecycle. The attack, which was mitigated by Google, highlights the risk of privilege escalation between AI agents in CI/CD pipelines.", "body_md": "#\nGoogle ADK Agent-to-Agent Attack: Privilege Boundary Breakdown Calling Privileged CI Workflows from Low-Privilege Triage Agents\n\n##\n1. Basic Information\n\n-\n**Article Name**: I'll Just Call You: Agent-to-Agent Privilege Boundary Failures in CI/CD on Google's ADK Repository\n-\n**Publisher**: Pillar Security\n-\n**Publication Date**: August 3, 2026\n-\n**Original Source**: [Pillar Security](https://www.pillar.security/blog/ill-just-call-you-agent-to-agent-privilege-boundary-failures-in-ci-cd-on-googles-adk-repository)\n-\n**Related Sources**: [SecurityWeek](https://www.securityweek.com/gemini-agent-to-agent-attack-exposed-secrets-enabled-pull-request-tampering/)\n-\n**Related Products**: Google Agent Development Kit for Python, Gemini CLI, GitHub Actions, GitHub MCP server\n-\n**Related Workflows**: `pr-triage.yml`\n\n, `gemini-dispatch.yml`\n\n, `gemini-invoke.yml`\n\n, `gemini-review.yml`\n\n-\n**Attack Status**: Security research that verified the conditions in a real production repository. Mitigated by Google. No active exploitation confirmed.\n-\n**Severity**: High\n\n##\n2. Executive Summary\n\nThis is an attack where a low-privilege triage agent is manipulated via prompt injection hidden in an external PR. The agent posts a comment using a collaborator identity to recursively trigger a privileged Gemini workflow. Through runner RCE and the `GITHUB_TOKEN`\n\n, the attacker spoofs reviews, comments, and labels.\n\n##\n3. Attack Flow\n\n###\nChain A: Privilege Escalation Between Agents\n\n- An external attacker creates a PR on\n`google/adk-python`\n\n.\n- The attacker embeds a prompt injection in the PR body, disguised as contribution guidelines.\n- The public-facing\n`adk_pr_triaging_agent`\n\nprocesses the PR.\n- The agent posts a comment using a Personal Access Token (PAT) linked to a collaborator user.\n- As instructed by the attacker, the agent outputs\n`@gemini-cli <prompt>`\n\nat the start of the comment.\n-\n`gemini-dispatch`\n\ndetermines that the command comes from a trusted collaborator.\n- It triggers high-privilege workflows named\n`gemini-invoke`\n\n/`gemini-review`\n\n.\n- The privileged agent leaks the MCP tool list.\n- Because\n`tools.core`\n\nis not set, it reaches all bash commands on the runner.\n- It accesses the environment's\n`GITHUB_TOKEN`\n\n.\n\n###\nChain B: Spoofing the PR Approval Lifecycle\n\n- After gaining trust, the attacker creates PR A containing malicious code.\n- The attacker places a prompt injection in another PR B.\n- Agent processing on PR B uses the\n`GITHUB_TOKEN`\n\nto modify PR A.\n- It overwrites the triager's existing comment to fake a review request.\n- It posts an in-progress review comment and an approval review under the bot's name.\n- It dismisses the genuine review request and changes the label to\n`approved`\n\n.\n- It presents a trail that looks legitimately reviewed to human maintainers.\n-\n**Additional Condition**: Final merging requires human judgment or social engineering.\n\n###\nChain C: Non-Interactive RCE in Other Automations\n\nPillar found another vulnerability in Antigravity-SDK-related automations that leads to RCE without maintainer action. Details are limited, and Google fixed it by the end of July 2026.\n\n##\n4. Attacker Position and Execution Location\n\n-\n**Attacker**: Inputs via GitHub PRs/issues as an external contributor.\n-\n**Low-Privilege Execution Location**: ADK agent/workflow for PR triage.\n-\n**Privilege Bridge**: Agent comments posted as a collaborator user.\n-\n**High-Privilege Execution Location**: `gemini-invoke`\n\n/`gemini-review`\n\nGitHub Actions runner.\n-\n**Target of Operation**: GitHub issues, PRs, reviews, labels, review requests, and runner environments.\n\n##\n5. Visibility to Victims and Administrators\n\nThe PR body looks like a normal summary, testing plan, and CLA note. The agent comments, GitHub Actions bot reviews, and labels also look like normal automation outputs. Individual events are permitted token actions. Abnormalities are hard to spot without tracing the provenance chain: \"untrusted PR content was converted into a privileged workflow trigger via a collaborator agent.\"\n\n##\n6. Success and Failure Conditions\n\n###\nSuccess Conditions\n\n- The agent processes untrusted PR/issue content as a prompt.\n- Agent output is posted as a collaborator/member identity.\n- The comment trigger trusts the poster's permissions rather than the actual human actor.\n- The privileged agent has a broad tool scope and reaches the runner shell.\n- The\n`GITHUB_TOKEN`\n\nhas `issues: write`\n\n/`pull-requests: write`\n\npermissions.\n- Supply-chain compromise relies on humans trusting the fake review and merging.\n\n###\nFailure Conditions\n\n- A data boundary that does not treat untrusted content as instructions.\n- Requiring signed capabilities and an explicit allowlist for agent-to-agent hand-offs.\n- Implementing the bot as a short-lived GitHub App token instead of a collaborator user/PAT.\n- Minimizing\n`tools.core`\n\nand MCP tools, and forbidding shells.\n- Not counting agent approvals as human approvals for branch protection.\n- Validating the original human actor and taint/provenance when a comment triggers an action.\n\n##\n7. What Happens on Success\n\nRunner RCE, acquisition of the `GITHUB_TOKEN`\n\n, tampering with issues/comments, dismissal of review requests, and spoofing of PR reviews/labels become possible. Merging malicious PRs requires additional human action, but the entire review lifecycle can be convincingly forged to provoke a software supply chain compromise.\n\n##\n8. Observable Logs\n\n###\nEmail\n\n- GitHub review, mention, and workflow notifications.\n- Notifications alone make it hard to distinguish from normal automation.\n\n###\nProxy / SWG / DNS\n\n- Unusual requests from the runner to the GitHub GraphQL API.\n- Access from agents/MCPs to unexpected external endpoints.\n\n###\nEndpoint / EDR\n\n- GitHub-hosted runners may lack organizational EDR.\n- Shell commands, environment access, and process trees on self-hosted runners.\n\n###\nIdentity / IdP\n\n- Agent comments using a collaborator user PAT.\n- Reviews, comments, and label changes using the\n`github-actions[bot]`\n\ntoken.\n- Review dismissals and approvals with no human activity.\n\n###\nSaaS / Cloud\n\n- Cross-object operations where PR B's workflow modifies PR A.\n- Privileged workflow dispatches immediately following\n`@gemini-cli`\n\ncomments.\n- Editing existing comments, deleting review requests, and adding approved labels.\n- Mismatch between the workflow run actor and the input source PR.\n\n###\nNetwork\n\n- A series of mutations to the GitHub API.\n- Token exfiltration attempts if runner egress control is present.\n\n##\n9. Determining Attack Success\n\n-\n**Contact Only**: A PR/issue containing a prompt injection is created.\n-\n**User Action**: Not required; low-privilege agent processing starts. Final merge requires human action.\n-\n**Initial Execution**: The agent posts a `@gemini-cli`\n\nhand-off.\n-\n**Authentication/Privilege Success**: Privileged workflow launch, shell/tool access, and token access.\n-\n**Session/Information Compromise**: Acquisition of the tool list or `GITHUB_TOKEN`\n\n.\n-\n**Subsequent Compromise Confirmation**: Modification of comments/reviews/labels on other PRs, and merging of malicious PRs.\n\n##\n10. Investigation Playbook\n\n###\nTrigger\n\n- Agent-generated\n`@gemini-cli`\n\noriginating from an untrusted PR.\n- Cross-PR mutations by bots or collaborators.\n- Agent workflows escaping shell/tool scopes.\n\n###\nInitial Verification\n\n- Preserve workflow runs, event payloads, PR bodies, and agent prompts/outputs.\n- Separate the original actor of the trigger comment from the generation entity.\n- Check token permissions, MCP/core tools, and secret exposure.\n\n###\nEndpoint / Runner\n\n- Shell commands, environment reads, network egress, and artifacts.\n- For self-hosted runners, rebuild images and rotate credentials.\n\n###\nAuthentication / Cloud\n\n- Issuing entity, scope, and all mutations of PATs/GITHUB_TOKENS.\n- Subsequent use of GitHub Apps, repository secrets, and OIDC tokens.\n\n###\nSubsequent Operations\n\n- Search for comment edits, review dismissals, labels, and approvals across all PRs/issues.\n- Cross-check repositories, branches, and releases touched by the agent.\n\n###\nContainment\n\n- Stop workflows, revoke PATs/tokens, and strip agent account permissions.\n- Invalidate agent approvals in branch protection settings.\n- Re-run affected reviews and verify releases/artifacts.\n\n###\nJudgment Categories\n\n- Prompt Injection Attempt\n- Agent Hand-off Triggered\n- Privileged Workflow Reached\n- Runner/Token Compromise\n- PR Lifecycle Tampered\n- Supply-Chain Merge Confirmed\n\n##\n11. Defense and Detection Ideas\n\n###\nSingle Events\n\n-\n`@gemini-cli`\n\nat the beginning of an agent comment.\n- Editing of existing human comments by a bot.\n- Review request dismissal via a workflow token.\n\n###\nTime-Series Correlation\n\nUntrusted PR → Triage agent → Collaborator comment → Privileged workflow → Shell/token → Cross-PR review/label mutation.\n\n###\nHunting Perspectives\n\n- Differences between the workflow trigger actor and the prompt origin.\n- A run from PR X modifying PR Y.\n- Command-like comments by agent accounts/PATs.\n- Approval trails without human sessions.\n\n###\nLog Gaps\n\n- Agent prompt/output/tool-call logs.\n- Input provenance/taint.\n- Complete audit of GitHub token API mutations.\n- Hosted runner process/network logs.\n\n###\nPriority Countermeasures\n\n- Do not re-interpret agent output as trusted commands.\n- Establish an explicit authorization gateway between low- and high-privilege agents.\n- Minimize agent tokens/tools and separate shells from secrets.\n- Distinguish human approvals cryptographically and by identity.\n- Track PR/issue content end-to-end as untrusted data.\n\n##\n12. Facts / Inference / Hypothesis\n\n###\nFacts\n\n- The Google ADK repository contained both a low-privilege agent and a high-privilege agent for maintainers.\n- Prompt injection forced the low-privilege agent to post a\n`@gemini-cli`\n\ncomment, launching a privileged workflow.\n- Due to poor tool scoping, the privileged workflow reached bash and could access the runner's\n`GITHUB_TOKEN`\n\n.\n- Token permissions allowed manipulation of comments, reviews, labels, and review requests.\n- Google implemented mitigations. No exploitation has been reported.\n\n###\nInference\n\n- Agent-to-agent hand-offs represent a new identity delegation boundary; natural language output must not be treated as an authorization token alone.\n- Even minimum-privilege tokens can forge human trust signals when multiple mutations are combined.\n\n###\nHypothesis\n\n- Preserving prompt provenance and the GitHub object mutation graph enables high-accuracy detection of agent-initiated cross-privilege escalation.\n\n##\n13. MITRE ATT&CK Mapping\n\n###\nHigh Confidence\n\n-\n**T1195.002** Compromise Software Supply Chain (when final merge succeeds)\n-\n**T1059.004** Unix Shell\n-\n**T1528** Steal Application Access Token\n-\n**T1098** Account Manipulation / Operating authorized automation (conceptual match)\n-\n**T1565.001** Stored Data Manipulation\n\n###\nMedium/Low Confidence\n\n-\n**T1078** Valid Accounts (use of agent PAT/token)\n-\n**T1036** Masquerading (fake approval trail)\n- Prompt injection and agent-to-agent delegation themselves are not fully represented in Enterprise ATT&CK and require custom technique supplements.\n\n##\n14. Unknowns / Further Investigation\n\n- Precise workflow designs after mitigation.\n- Details of the RCE on the Antigravity-SDK side.\n- Presence of actual exploitation.\n- Other repositories accessible by the agent PAT.\n- How long GitHub audit logs retain before/after comment edits.\n- The prevalence of similar multi-agent CI implementations.\n\n##\n15. Impact on SOCs and Organizations\n\nOrganizations adopting AI code review and triage must manage agents not merely as \"convenient bots,\" but as service identities. SOCs and AppSec teams should monitor not only prompt injection detection, but also input provenance, agent-to-agent delegation, tool permissions, and the authenticity of PR approvals as a unified set of controls.\n\n##\n16. Summary\n\n###\nFor SOCs\n\n- Monitor PR input → agent output → privileged workflow → GitHub mutation as a single chain.\n- Distinguish between bot approvals and human approvals.\n- Investigate cross-PR operations and comment edits with high priority.\n\n###\nFor Administrators\n\n- Minimize agent accounts/PATs, MCPs, shells, and token permissions.\n- Do not trigger privileged workflows directly from agent outputs.\n- Require independent human reviews in branch protection rules.\n\n###\nFor Users\n\n- Do not merge based solely on AI review indicators; check original reviewers, workflow runs, and change histories.", "url": "https://wpnews.pro/news/google-adk-agent-to-agent-attack-privilege-boundary-breakdown-calling-privileged", "canonical_source": "https://dev.to/anoymask/google-adk-agent-to-agent-attack-privilege-boundary-breakdown-calling-privileged-ci-workflows-from-2ii6", "published_at": "2026-08-05 02:54:03+00:00", "updated_at": "2026-08-05 03:09:23.865889+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-policy"], "entities": ["Pillar Security", "Google", "Agent Development Kit", "Gemini CLI", "GitHub Actions", "GitHub MCP server", "SecurityWeek"], "alternates": {"html": "https://wpnews.pro/news/google-adk-agent-to-agent-attack-privilege-boundary-breakdown-calling-privileged", "markdown": "https://wpnews.pro/news/google-adk-agent-to-agent-attack-privilege-boundary-breakdown-calling-privileged.md", "text": "https://wpnews.pro/news/google-adk-agent-to-agent-attack-privilege-boundary-breakdown-calling-privileged.txt", "jsonld": "https://wpnews.pro/news/google-adk-agent-to-agent-attack-privilege-boundary-breakdown-calling-privileged.jsonld"}}