Google removes AI agent workflows after a GitHub issue could hijack a privileged agent

Pillar Security showed that Google's Agent Development Kit repository could be turned against itself through a poisoned pull request or issue. The public repository ran a low-privileged triage agent that responded to outside contributions, and a higher-privileged agent reserved for maintainers. Because the triage agent posted through a bot account that counted as a repository collaborator, a prompt injection could make it post a command that satisfied the privileged workflow's trust check, invoking the maintainer-level agent. That crossed into a job holding a long-lived access token, a Google API key, and a cloud service-account credential, enabling code execution on the runner and secret theft. Google deleted the affected workflows.

Check

Review any AI agent workflows that act on untrusted pull requests or issues, and check whether a low-privileged agent can trigger a higher-privileged one through a shared bot identity.

Affected

Teams running tiered AI agent workflows in code repositories; untrusted issue or pull-request content can prompt-inject a public agent into invoking a privileged one, exposing continuous integration secrets and code execution.

Fix

Give agents scoped, non-collaborator identities, keep untrusted content from reaching privileged workflows, require human approval for sensitive agent actions, and minimize the tokens and credentials an agent job can access.