AINEWS
Pillar Security's disclosure in Google's Agent Development Kit for Python shows why two AI agents need separate identities, and what happens when they don't.
A security flaw in an AI coding assistant just produced a new attack class. A single malicious code change, reviewed by one AI assistant, can carry hidden instructions that a second AI assistant then executes as if they came from the developer. Pillar Security researcher Dan Lisichkin disclosed the chain this week in google/adk-python, the public repository behind Google's Agent Development Kit for Python, and called it the first real-world exploitation in a production multi-agent system.
The mechanism is not prompt injection. It is identity laundering. Two software agents shared a trust boundary: a public-facing one that triages pull requests from outside contributors, and a high-privilege one that maintainers invoke by commenting "@gemini-cli" on a PR. Both ran in the same CI/CD system, but the low-privilege agent was wired to a personal access token belonging to a human Collaborator rather than to a bot or GitHub App identity, so any text it produced carried that user's high-privilege authority. The "identity" of the public triage agent was, in practice, a maintainer with the keys to the repository.
The exploit takes patience and one poison pill. An outside attacker opens a plausible PR containing a malicious change, such as a tampered package.json or a new dependency that phones home, and waits for the public triage agent to handle it. Then they open a second PR whose text prompt-injects the triage agent into emitting a comment that looks like a maintainer asking Gemini to run a job. The dispatch workflow catches the "@gemini-cli" mention, fires the privileged gemini-invoke workflow, and follows the injected instructions. The audit trail at the end looks like a human asked, Gemini ran it, and Gemini approved it.
Pillar's write-up shows the relevant files: pr-triage.yml runs on every PR, open to anyone, while gemini-invoke.yml, gemini-review.yml, and gemini-dispatch.yml are gated to repository members, collaborators, and authors. Independent evidence that prompt injection of the triage agent was already feasible came earlier, when an outside researcher's PR #5884 on the same repository got the agent to emit a literal "POC-MARKER-verify" string. The Pillar chain extends that one step: it does not just make the public agent say something, it makes the privileged agent act on it.
The package behind the repository is the google-adk Python SDK on PyPI, which The Register reports has logged more than 90 million downloads over the past 90 days. That figure is a rolling PyPI download counter, not a count of unique installations, so the real deployment footprint is smaller. It is still large enough to put the disclosure in front of a meaningful share of teams building AI agents on Google's stack.
Google confirmed the issue was fixed in the repository and granted Lisichkin credit, but did not pay a bug bounty. The company's rationale, as reported by The Register, is that the demonstrated exfiltration was a GitHub token with pull-requests: write, enough to tamper with a PR but not enough to merge it without a maintainer, and that "we don't reward vulnerability reports that require social engineering to enable a supply chain security compromise." Lisichkin's chain does require a legitimate-looking first PR to seed the prompt injection. Google is reading the bar high. Readers can decide whether a multi-agent CI/CD system that lets one agent's output steer another without an identity check is a bug bounty line item or a design call.
Lisichkin's fix is small, specific, and worth lifting. Give each agent its own identity scoped to specific resources and tools, the way a CI runner gets a service account rather than a developer's laptop credentials. Treat the public triage agent as untrusted input to the privileged agent, even though both run inside the same repository. Add agent identity and agent resource access to the threat model the way application security teams already add third-party dependencies. The lethal trifecta Lisichkin named in a prior Pillar write-up, untrusted input plus tool execution with secrets plus exfiltration, still applies. The disclosure this week adds the missing piece the model should have had from the start: a per-agent identity boundary.
Lisichkin will present the full chain at DEF CON AI Village on Friday, August 7, 2026 at 1600 PDT. The talk is a poster session. Teams wiring their own coding agents to maintainer-level tokens have the four days between now and Friday to read Pillar's write-up and decide whether their threat model covers this case.