Security researchers at Pillar Security say they have discovered a new attack technique in which an AI agent manipulates a second, more powerful AI agent to perform actions for which the first agent lacks the necessary permissions. The vulnerability was found in the GitHub repository for Google’s Agent Development Kit (ADK) for Python and exposes a new attack vector for organizations that deploy multiple AI agents within their development pipelines.
The researchers describe these as the first real-world examples of a so-called “agent-to-agent” attack in a production environment. Unlike known prompt-injection attacks, this attack does not target a single AI agent, but rather the trust relationship between multiple agents collaborating within the same CI/CD pipeline. Google’s ADK for Python is also widely used, with over 90 million downloads to date.
Trust between agents proves to be a weakness
In the repository under investigation, several agents with varying levels of permissions were running. A publicly accessible agent analyzed GitHub issues and pull requests, while a second agent performed tasks on behalf of maintainers with significantly broader permissions.
According to the researchers, the problem arose because both agents implicitly trusted each other’s output. By injecting a prompt into a pull request, the first agent could generate a command for the second, which then executed actions with higher privileges. According to Pillar Security, this could theoretically have led to the misuse of GitHub tokens, access to Google Cloud accounts, and ultimately a software supply chain attack.
Researcher Dan Lisichkin warns that this creates a new type of attack that many existing threat models do not yet account for. According to him, the issue is no longer solely about the security of individual AI agents, but also about the way they interact with one another.
The attack consisted of several steps. First, an attacker submitted a seemingly legitimate pull request to build trust. This was followed by a second pull request that included a prompt injection, causing the public AI agent to activate a privileged agent. This created a credible chain of automated approvals, while the final actions were in fact directed by the attacker, The Register adds.
Google saw no reason for a bug bounty
Google has since fixed the vulnerability by modifying the repository’s workflow. However, no financial reward was offered for the report. According to the company, the attack still required a human maintainer to approve the malicious pull request. As a result, the attack relied heavily on social engineering and therefore did not qualify for the bug bounty program.
Pillar Security argues that traditional security measures for AI agents are no longer sufficient. According to the researchers, each agent must be assigned its own identity and a strictly defined permissions profile, so that they cannot forward commands to agents with greater privileges without additional checks.