Pillar Security disclosed on August 3 two now-patched privilege-boundary weaknesses in Google's ADK for Python repository. One let prompt injection cross from a public triage agent to a maintainer-only workflow and fabricate review activity; a later Antigravity-based path could expose credentials and enable runner code execution without maintainer interaction, according to Pillar and SecurityWeek.
Pillar Security disclosed on August 3, 2026, two now-patched privilege-boundary weaknesses in the repository for Google's Agent Development Kit for Python. Both involved public-facing automation reaching workflows or credentials intended for trusted maintainers.
The first path let a prompt injection handled by a pull-request triage agent trigger a separate, higher-privilege workflow. Pillar said Google hardened the repository after disclosure. Google did not award a bounty for that path because a maintainer would still have needed to merge the malicious pull request, making social engineering part of the proposed supply-chain scenario.
A natural-language handoff crossed the trust boundary
Pillar found that the public triage agent commented through an account with collaborator privileges. A crafted pull request could persuade that agent to emit an @gemini-cli handoff, which the repository's dispatch workflow treated as a trusted trigger for maintainer-only automation.
In Pillar's proof of concept, the privileged workflow could be used to edit or delete comments and issues, dismiss review requests, and submit misleading approval activity. Those actions could make a malicious pull request look reviewed, but the first path did not automatically merge code and still depended on a maintainer taking the consequential step.
A later workflow exposed a more direct route
Pillar separately reported an Antigravity-SDK-based automation added to the same repository. Its public issue-analysis workflow could be prompt-injected into posting the trusted command that launched a privileged issue-fix agent. Because that agent ran with a long-lived bot token and Google Cloud credentials, Pillar said the path could lead to runner code execution and credential exposure without a maintainer interaction.
SecurityWeek reported that Google removed the affected workflows and fixed the later weakness in July. Pillar's disclosure timeline says Google confirmed the fix on July 21.
Implications for agentic CI/CD
The case shows why tool permissions alone do not create a reliable security boundary when one agent's natural-language output can authorize another. Public pull-request text, issue bodies, repository content, and agent-generated summaries all need to remain untrusted across handoffs.
Comparable systems are safer when privileged actions require structured and validated inputs, authorization signals that an upstream model cannot forge, narrow bot identities, short-lived credentials, and independent human review for merges or releases. Teams also need logs that preserve which user, workflow, and agent caused each downstream action.
Key Points #
- 1Pillar demonstrated that prompt injection in a public ADK triage agent could trigger a separate maintainer-only workflow through a natural-language handoff.
- 2The first path could fabricate convincing review activity but still required a maintainer to merge the pull request; Google hardened the repository after disclosure.
- 3A separate Antigravity-based workflow could expose a bot token and Google Cloud credentials and enable runner code execution without maintainer interaction before Google fixed it in July.
Scoring Rationale #
Pillar documented practical privilege-boundary failures in a production multi-agent repository workflow, including a prompt-injected agent handoff and a later credential-exposing runner path. Google fixed the issues, and the first supply-chain scenario still required a maintainer merge, but the patterns are directly relevant to teams deploying agents in CI/CD.
Sources #
Primary source and supporting public references used for this report.
Practice with real Ad Tech data
90 SQL & Python problems · 15 industry datasets
[Active Search Campaigns by BudgetEasy](/problems/sql/active-search-campaigns-by-budget)
[High CPC Clicks & Poor Landing PagesMedium](/problems/sql/high-cpc-clicks-poor-landing-page)
[Campaign ROAS by Attribution ModelHard](/problems/sql/campaign-roas-by-attribution-model)
250 free problems · No credit card