Google Deletes ADK AI Workflows After GitHub Prompt Injection Flaw

Google has removed three AI agent workflows from its Agent Development Kit (ADK) Python repository after Pillar Security demonstrated that a malicious public GitHub issue could be weaponized to hijack a privileged code-fixing bot and steal its credentials. The researchers showed that prompt-injecting the public triage agent into posting the command /adk-issue-fix as adk-bot was enough to satisfy the privileged workflow's owner, member, or collaborator gate — turning the trusted bot identity into an authorization bridge that outsiders could exploit. The exposed component was the repository automation itself, not a flaw in the distributed ADK Python package, and Google has not identified any in-the-wild exploitation or compromised ADK release.

The attack path began in the public issue-analyze.yml workflow, which authenticated with ADK_GCP_SA_KEY, supplied ADK_TRIAGE_AGENT and a GOOGLE_API_KEY to Google's Antigravity coding agent, and posted the generated analysis as a comment using the bot account. A separate issue-fix.yml workflow listened for the trigger command and restricted execution to authorized accounts — but verified only who posted the comment, not whether an outsider had manipulated the trusted account behind it. The privileged job declared write access to issues, contents, and pull requests, checked out the repository using the PAT, and authenticated to Google Cloud. Although the runner rejected shell metacharacters and limited commands to gh or git, the script enabled CapabilitiesConfig(), which Google's Antigravity SDK documentation says turns on all tools, including writes. The agent could then write a payload and force execution through an allowed Git command via a custom hook path.

Pillar Security demonstrated arbitrary code execution on the CI runner and exfiltration of the bot's personal access token, which also held a Google API key and a Google Cloud service-account credential. Organizations using GitHub-based automation should run a privacy checkup on stored CI secrets and verify whether exposed tokens appeared in any known dumps using an email breach checker. For similar repositories, Pillar recommends separate bot identities for read-only and privileged tasks, narrower token and tool scopes, and an authorization signal that untrusted user text cannot forge. The Hacker News reported that responses from Google regarding the bot token's scopes and from Pillar regarding the proof-of-concept environment were still pending at the time of publication, while a bot-generated pull request dated June 4 confirmed the automation was actively operating in the repository before removal.