Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent

Google has removed three AI agent workflows from its Agent Development Kit (ADK) Python repository after researchers at Pillar Security demonstrated that a malicious GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent. The attack, which exploited prompt injection and an authorization gap, could lead to arbitrary code execution on the CI runner and exfiltration of sensitive credentials.

The attack chain began with the public issue-analyze.yml workflow, which automatically analyzed new issues and posted comments using a bot account. A separate issue-fix.yml workflow listened for /adk-issue-fix comments and restricted execution to repository owners, members, or collaborators. However, the gate only checked who posted the command, not whether an outsider had manipulated the trusted bot account. By prompt-injecting the triage agent, the researchers made it post the command as the bot, which was a collaborator, thereby satisfying the authorization check.

The privileged job had broad permissions, including write access to issues, repository contents, and pull requests. It used a personal access token (PAT) and a Google API key, and also had access to a Google Cloud service-account credential. The researchers demonstrated arbitrary code execution on the CI runner and exfiltration of the bot PAT. They noted that the exposed component was the repository automation, not the distributed ADK Python package itself.

Pillar Security recommends that similar repositories use separate bot identities, narrower token and tool scopes, and an authorization signal that untrusted text cannot generate. Google deleted the three workflows in a patch dated June 9, 2026, and confirmed the fix on July 21. The Hacker News verified on August 4, 2026, that the files were no longer present in the repository’s main branch.