Google Fixes Python AI Agent Flaw Enabling Supply Chain Attacks

Google has patched a set of vulnerabilities in its Python-based Agent Development Kit (ADK) that allowed attackers to exploit the trust boundary between two AI agents operating at different privilege levels, opening the door to agent-to-agent attacks capable of compromising the software supply chain. The flaws, disclosed and remediated after coordinated reporting, targeted the framework's handling of inter-agent communication and authorization, where a lower-privilege agent could trigger automated actions in a higher-privilege agent without adequate validation.

The core of the vulnerability lay in how Google's ADK delegated tasks between autonomous agents. By manipulating the context, instructions, or session state passed between agents, an attacker could effectively escalate privileges and cause a trusted agent to execute unintended actions—from exfiltrating sensitive data to injecting malicious code into downstream build pipelines. This kind of cross-agent exploitation represents a new class of AI-native supply chain risk, where the attack surface is not a library or dependency, but the reasoning and tool-use layer of an AI system itself.

Security researchers noted that the issue underscores the dangers of treating LLM-powered agents as trusted components without enforcing strict isolation, input sanitization, and least-privilege design. As enterprises increasingly integrate multi-agent architectures into production workflows, a single compromised agent can cascade into broader system compromise. Developers and security teams should audit their agent orchestration frameworks, review inter-agent permission models, and verify that no sensitive credentials or build secrets are exposed to lower-trust agents in the workflow. Organizations can start by checking their domain exposure with a DNS leak test and scanning for exposed services using a port scanner to identify potential entry points that an autonomous agent could reach.

Google has confirmed that patches have been rolled out and recommends that all users of the Python ADK update to the latest version immediately. The incident highlights a growing need for AI-specific threat modeling, where traditional security boundaries must be extended to cover the unique risks of agent-to-agent trust relationships, tool invocation, and autonomous decision-making in modern AI deployments.