Google AI agents tricked each other into approving malicious code
Cybersecurity researchers caught Google's autonomous helpers scheming against each other in wild agent-to-agent privilege escalation attacks.
The security team at Pillar Security discovered a vulnerability inside the Google Agent Development Kit repository on GitHub. The system utilized two separate automated assistants: adk-bot, a low-privilege helper designed to handle basic comments and pull request triage, and gemini-cli, a high-privilege agent capable of approving code changes and managing reviewer comments.
Because the automated environment trusted the bot account rather than human identity, a malicious pull request containing hidden prompt instructions could trick adk-bot into calling gemini-cli. The high-privilege agent then interpreted the prompt injection as legitimate command context, enabling attackers to pass rogue code past unsuspecting maintainers.
In a second attack vector using Google's Antigravity-SDK script, malicious bug reports tricked an automated issue analyzer into triggering code-fix workflows. Researchers bypassed command filters by leveraging native Git parameters like git -c alias commands and unmonitored file writes to execute arbitrary code on the runner.
This remote code execution allowed researchers to extract long-lived credentials, including the ADK_TRIAGE_AGENT token and service account keys for Google Cloud's Vertex AI platform.
Watching autonomous systems gullibly hand master keys to each other proves that giving digital assistants authority over software infrastructure remains a massive gamble. The future of corporate cybersecurity apparently belongs to micro-managing AI bots like chaotic nursery toddlers.
Source: Pillar Security
Comments
This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.