Pillar Security discovered an agent-to-agent attack method in Google’s Agent Development Kit for Python that could lead to secret exposure and pull request (PR) poisoning. The google/adk-python repository had two classes of automated AI agents: low-privileged ones open to user interaction, and high-privileged ones accessible only to maintainers. An attacker could manipulate the low-privileged, public-facing agent to pass a prompt to the high-privileged one, gaining access to restricted capabilities, including command execution, and potentially opening the door to supply chain compromise. The company found a way to manipulate an agent into posting an @gemini-cli <prompt> as a comment on a PR, which triggered gemini-invoke and provided access to a more privileged workflow. The initial prompt triggered a response that leaked the tools the privileged agent had access to via the MCP server, revealing that the bot had access to every bash command, meaning the researcher could execute code remotely and potentially extract the agent’s GitHub token. This allowed the researcher to modify comments, PRs, and issues of other maintainers, collaborators, and members; dismiss reviews or approve PR changes; and invoke gemini-invoke and gemini-review against any PR. This also enabled poisoning the PR approval lifecycle, but any malicious PR would have to be approved and merged by a member, requiring social engineering. Google was notified in early June and addressed the issue through hardening, but did not