AIDEFEND in Action AIA-0090 Validated Research Published: Oct 1, 2026

Google ADK Repository Agent-to-Agent CI Privilege Crossing

Pillar Security showed that attacker-controlled PR text could make google/adk-python's public triage agent post a first-line @gemini-cli comment. Because the agent used a collaborator account, gemini-dispatch treated that comment as authorized and started gemini-invoke. The initial handoff was reproduced in a research lab; further token and review-manipulation impacts were demonstrated or analyzed, not a confirmed malicious merge. Google hardened the repository.

Indirect Prompt InjectionTool AuthorizationA2A SecurityGitHub Security
5 applicable AIDEFEND defenses
Source: I'll Just Call You: Agent-to-Agent Privilege Boundary Failures in CI/CD on Google's ADK Repository 
Author: Dan (danusminimus)
Original article: Aug 3, 2026

Threat Analysis

A low-trust PR became a high-trust workflow request because the first agent commented through a collaborator user identity. The receiving Gemini dispatch workflow checked the commenter's apparent role, not the root requester or whether review authority had actually been delegated.

  1. A PR description portrays a first-line @gemini-cli comment as the repository's normal triage procedure.
  2. The public-facing ADK triage agent processes the PR text and posts the requested comment using adk-bot, a collaborator user identity rather than a low-trust bot identity.
  3. The dispatch workflow accepts the collaborator's @gemini-cli comment and routes it to gemini-invoke; it has not independently verified the real request origin or delegated task.
  4. The second workflow receives the attacker-shaped prompt in a stronger CI context. The researcher demonstrated the handoff and investigated token and PR-review operations within its actual scopes.
  5. The researcher built a PoC for editing review-related comments, labels, or approval signals. A maintainer still had to merge a PR; no malicious merge was reported.

The researcher reproduced the cross-agent trigger in a controlled environment and demonstrated further token or review-signal paths. The reported permissions still required a maintainer to merge a PR; Google said it hardened the repository. This is not evidence that a malicious release was merged.

Applicable AIDEFEND Defenses (5)

AID-H-004.003
Secure Agent-to-Agent Communication
Very High
Before gemini-dispatch starts a privileged job, verify the registered root principal, approved task and non-widening delegation from trusted records bound to this request. The GitHub event identifies the commenter but does not prove the original requester or an approved delegation chain. A collaborator PAT or automation-authored comment alone is insufficient and must not trigger privileged execution.
AID-H-018.002
Policy-Based Access Control
High
At the only GitHub tool adapter, authorize the exact repository, PR and review operation from verified task identity; an ordinary review may comment but may not APPROVE, dismiss reviews or alter authorization-bearing labels without a separately authorized task. Remove raw shell/direct API paths that bypass this decision. Independently disable Actions creation/approval of PRs, restrict effective job-token permissions and require human code-owner review. These platform settings support the adapter policy; they are not the package-release method in AID-H-023. A repository-scoped token is not a single-PR grant; the adapter must enforce the exact task and target.
AID-H-017.002
Least-Privilege Tool Architecture
High
Set an explicit tools.core allowlist for the privileged Gemini job and register only the typed PR-review operations it needs. With no shell primitive, an attacker-shaped prompt cannot read the job's GITHUB_TOKEN from the environment or call the GitHub API outside the MCP tool surface, which removes the token-harvest branch the researcher demonstrated.
AID-M-009.003
Agent Identity, Delegation Lineage & Authorization Context
Medium
If this workflow uses agent-to-agent delegation, record a verifier-signed chain from an authorized human review request through triage to dispatch. Each link must bind workload identity, task, expiry and a scope no broader than its parent; the receiver verifies the chain before considering a comment as a request. A plain GitHub comment or collaborator PAT has no such chain. This requires a purpose-built delegation service; it is not supplied by the repository's current author-association check.
AID-D-011.004
Non-Human Identity & Delegated Token Abuse Detection
Medium
Where GitHub Enterprise audit streaming or an equivalent event feed exposes the relevant actor, token and PR events, correlate bot review approvals or dismissals with the authorized workflow ledger and alert on an unapproved identity or scope. Verify event coverage and latency before relying on the detector; ordinary comment or label data alone does not prove which token instance acted.

What Defenders Should Do Now

  • Give automation its own narrow bot identity; do not let public-input agents comment through a collaborator's personal access token.
  • At every comment-triggered handoff, verify the root principal, delegated task and allowed capability independently of the account that posted the comment.
  • Restrict the receiving agent's final tool calls to the exact PR and task; keep human merge review and branch protection independent of bot-generated approval signals.

1 additional consideration

Evidence and deployment boundary

The original report also describes a separate issue-analyze to issue-fix route. This SecureFlow maps the PR-triage to Gemini-dispatch route and does not merge two different workflows into one causal sequence.
Recommendation: Give automation its own narrow bot identity; do not let public-input agents comment through a collaborator's personal access token.

Conclusion

AIDEFEND  places the controls at the agent handoff and the final tool call: the receiver verifies the original requester and bounded delegation, while the tool adapter checks the exact PR and operation. A comment account alone cannot authorize privileged review.

Last updated: