--- title: Google ADK flaws reveal what happens when AI agents... description: Security researchers at Pillar Security discovered two attack paths in Google's Agent Development Kit (ADK) GitHub repository that demonstrate real-world... canonical: https://daily.dev/posts/google-adk-flaws-reveal-what-happens-when-ai-agents-trust-the-wrong-message-h7xrhb3d6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Google ADK flaws reveal what happens when AI agents trust the wrong message | daily.dev og:description: Security researchers at Pillar Security discovered two attack paths in Google's Agent Development Kit (ADK) GitHub repository that demonstrate real-world... og:url: https://daily.dev/posts/google-adk-flaws-reveal-what-happens-when-ai-agents-trust-the-wrong-message-h7xrhb3d6 og:image: https://api.daily.dev/og/posts/H7xrHB3D6.png og:image:alt: Google ADK flaws reveal what happens when AI agents trust the wrong message og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Google ADK flaws reveal what happens when AI agents trust the wrong message **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary Security researchers at Pillar Security discovered two attack paths in Google's Agent Development Kit (ADK) GitHub repository that demonstrate real-world agent-to-agent privilege escalation. The first involved a triage agent that could be manipulated via malicious pull request content to trigger privileged CI/CD workflows, enabling fake approving reviews and comment manipulation. The second allowed prompt injection through a public issue to extract credentials including a personal access token and a Google Cloud service account key. Experts emphasize that agentic systems require 'delegation mapping' beyond traditional IAM tools, since natural language has effectively joined the authorization path, and that human approval steps can be undermined when the evidence presented to approvers is itself manipulated. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Cybersecurity Researchers Uncover Flaw in Google AI Coding Tool](https://daily.dev/posts/cybersecurity-researchers-uncover-flaw-in-google-ai-coding-tool-38fhs0zr4) · DevOps.com · 1 upvotes · 0 comments - [GitHub AI agent leaks private repositories via prompt injection attack](https://daily.dev/posts/github-ai-agent-leaks-private-repositories-via-prompt-injection-attack-ffq6gdzd6) · InfoWorld · 0 upvotes · 0 comments - [From Assistant to Adversary: Exploiting Agentic AI Developer Tools](https://daily.dev/posts/from-assistant-to-adversary-exploiting-agentic-ai-developer-tools-dl4yjs179) · NVIDIA Developer · 2 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#cicd](https://daily.dev/tags/cicd), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/google-adk-flaws-reveal-what-happens-when-ai-agents-trust-the-wrong-message-h7xrhb3d6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Google ADK flaws reveal what happens when AI agents trust the wrong message","url":"https://daily.dev/posts/google-adk-flaws-reveal-what-happens-when-ai-agents-trust-the-wrong-message-h7xrhb3d6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/google-adk-flaws-reveal-what-happens-when-ai-agents-trust-the-wrong-message-h7xrhb3d6"},"datePublished":"2026-08-04T11:44:25.369Z","dateModified":"2026-08-05T17:19:51.877Z","description":"Security researchers at Pillar Security discovered two attack paths in Google's Agent Development Kit (ADK) GitHub repository that demonstrate real-world...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/183370783cf99c258edd0880042a2e23?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/183370783cf99c258edd0880042a2e23?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/google-adk-flaws-reveal-what-happens-when-ai-agents-trust-the-wrong-message-h7xrhb3d6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,cicd,prompt-injection","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Google ADK flaws reveal what happens when AI agents trust the wrong message"}]} ```