- Pillar Security discovered a prompt-injection attack that could trick Google’s ADK triage agent into triggering a privileged code-fixing workflow.
- By exploiting a public GitHub issue, researchers achieved arbitrary code execution on the CI runner and exfiltrated a bot personal access token.
- Google deleted three vulnerable workflows from its ADK Python repository after the disclosure; no in-the-wild exploitation has been confirmed.
- The attack chain bypassed an owner/member/collaborator gate by using the trusted adk-bot identity, exposing Google Cloud credentials.
Pillar Security researchers demonstrated that a public GitHub issue could prompt-inject Google’s Antigravity coding agent into posting /adk-issue-fix as the trusted adk-bot account. The issue-analyze.yml workflow automatically analyzed opened issues and posted comments using the bot’s personal access token. That token satisfied the authorization gate for the separate issue-fix.yml workflow, which restricted execution to owners, members, or collaborators.
The triage workflow provided the agent with a Google API key and a Google Cloud service-account credential. Because the agent operated under the bot’s identity, an attacker could manipulate it into issuing the privileged command. Consequently, the researchers achieved arbitrary code execution on the CI runner and exfiltrated the bot PAT, as detailed in Pillar’s report.
The runner script restricted allowed commands to gh or git as the first token, but it enabled all Antigravity SDK tools, including file writes. The agent could write a payload and then use Git’s core.hooksPath, as described in Git documentation, to execute arbitrary code through a custom hook.
Google removed issue-analyze.yml, issue-fix.yml, and pr-analyze.yml in a patch dated June 9, 2026. Pillar confirmed the workflows were absent on July 2, and Google acknowledged the fix on July 21. The exposed component was the repository automation, not the distributed ADK Python package itself.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
