Pillar Security researchers said they discovered an exploit in Google’s Agent Development Kit for Python that allowed a low‑privilege AI agent to trigger actions of a high‑privilege agent. The kit, an open source Python toolkit used to build and deploy AI agents, has been downloaded more than 90 million times. Google updated the repository after the issue was identified.

The vulnerability involved two classes of AI agents that unintentionally shared a trust boundary. A public‑facing agent was activated whenever a pull request or issue was opened, while a maintainer‑only agent had elevated privileges. Researchers said a prompt injection could cause the low‑privilege agent to invoke the high‑privilege agent, enabling malicious actions. An attacker would first need to submit a legitimate‑looking pull request, which the public agent would review and mark for triage. The attacker could then open a second pull request containing a prompt injection that triggered a gated workflow, causing the privileged agent to execute the malicious code. The workflow could exfiltrate a GitHub token with write permissions, but a maintainer still had to merge the pull request for the action to be carried out. Google said the underlying issue was fixed and the report did not qualify for a bug‑bounty payment because it required social engineering. Pillar’s Dan Lisichkin said the findings demonstrate that agent isolation is insufficient and that agents should have distinct identities and resource access controls. He will present the research at DEF CON’s AI Village on August 7.

The case underscores the need for stronger agent identity and access modeling in automated development pipelines.