Google removed three AI agent workflows from its Agent Development Kit Python repository following a prompt injection vulnerability disclosed by Pillar Security. The flaw allowed attackers to manipulate a public triage agent through GitHub issues, potentially triggering execution of a privileged code-fixing agent with elevated permissions.
Pillar Security researchers demonstrated that an attacker could craft a malicious GitHub issue containing prompt injection payloads. When the triage agent processed the issue, injected commands could force it to post privileged commands like /adk-issue-fix as the adk-bot account. Since adk-bot held collaborator status on the repository, these commands would execute with elevated privileges.
The attack chain exploited a common weakness in AI agent systems. Large language models process both legitimate input and attacker-controlled data without inherent distinction between the two. By embedding malicious instructions within issue descriptions or comments, attackers bypassed intended control flows and triggered unintended agent actions.
The vulnerability posed direct risks to organizations using ADK for automated code review and repository management. An attacker could inject malicious code fixes, alter repository configuration, modify permissions, or deploy malicious commits under the bot's trusted account. Development teams relying on automated workflows would execute attacker-supplied code changes without human review.
Google's response involved deleting the affected workflows entirely rather than patching the underlying prompt injection vulnerability. This conservative approach removed the attack surface but also eliminated automation capabilities developers relied on. The company did not publicly disclose specific CVE identifiers for this issue.
This incident reflects a broader challenge in AI-powered development tools. As organizations integrate large language models into automated workflows, prompt injection becomes as critical as SQL injection or command injection in traditional software. Agents with repository access, deployment permissions, or code execution capabilities represent high-value targets. Security teams adopting AI agents in CI/CD pipelines, code review systems, or infrastructure automation