Opening SecureFlowGoogle ADK Repository Agent-to-Agent CI Privilege Crossing
Case summary & sources

AIDEFEND SecureFlow / SecureFlow Case Index

Pillar Security aidefend-sf0051

Google ADK Repository Agent-to-Agent CI Privilege Crossing

  • Autonomous Agents
  • Credential & Identity Theft
  • Data Corruption

Pillar Security showed that attacker-controlled PR text could make google/adk-python's public triage agent post a first-line @gemini-cli comment. Because the agent used a collaborator account, gemini-dispatch treated that comment as authorized and started gemini-invoke. The initial handoff was reproduced in a research lab; further token and review-manipulation impacts were demonstrated or analyzed, not a confirmed malicious merge. Google hardened the repository.

Mapped threat techniques

  • AML.T0051.001 LLM Prompt Injection: Indirect
  • AML.T0053 AI Agent Tool Invocation

Source

Updated