A hacking technique against Google ADK has been discovered that involves 'hacking low-privilege agents and executing code with higher privileges.'



Google has released the

Agent Development Kit (ADK), an agent development framework that supports enterprise-scale development. Security firm Pillar has discovered a vulnerability in this ADK that allows for attacks that 'hack low-privilege agents and execute code with higher privileges.'

I'll Just Call You: Agent-to-Agent Privilege Boundary Failures in CI/CD on Google's ADK Repository
https://www.pillar.security/blog/ill-just-call-you-agent-to-agent-privilege-boundary-failures-in-ci-cd-on-googles-adk-repository

Google's ADK is a system that allows you to deploy AI agents on GitHub and other platforms to handle code reviews and other tasks. While the agents are generally designed to comment only on predefined content, it has been revealed that it is possible to make the agents output arbitrary phrases by using a method called 'submitting a pull request with code that includes prompts.'

For example, the following pull request instructs the agent to output 'Marker: POC-MARKER-verify-1779978519'.



The comment history for the pull request is as follows. The agent's comments contain the text 'Marker: POC-MARKER-verify-1779978519'. It was also discovered that the agent is treated as a 'collaborator' rather than a 'bot' on GitHub's system, and can invoke 'maintainer-only workflows' that are normally only permitted for humans.



Based on the results above, Pillar carried out a prompt injection attack to trick agents into calling a 'maintainer-only workflow.' Although agents were designed to ignore problematic prompts, by constructing malicious prompts in accordance with

Google's official Contribute Guide , they succeeded in triggering the maintainer-only agent from a low-privilege agent, thereby impersonating a 'maintainer with the authority to reject and approve pull requests.'



Pillar has reported the issue to Google, and mitigation measures have already been implemented. Pillar points out, 'This discovery indicates that new attack surface areas are not reflected in the threat model. Security professionals need to consider agent-based attack scenarios, create threat models, and verify the scope of impact.'

Related Posts:

in AI, Posted by log1o_hf