In a notable development, researchers from Pillar Security have identified a vulnerability within Google’s Agent Development Kit (ADK) for Python, which could allow one AI agent to control another with higher privileges. This incident marks what is described as the first real-world instance of agent-to-agent exploitation.
Details of the Vulnerability
The vulnerability resides in the google/adk-python repository, an open-source toolkit that has been downloaded over 90 million times for creating AI agents. The issue arises from the interaction between two classes of automated AI agents operating at different privilege levels. The low-privilege agent, which is public-facing and activated during pull request (PR) or issue submissions, can be manipulated to trigger actions from a high-privilege maintainer-only agent.
Mechanics of the Attack
According to Dan Lisichkin from Pillar Security, the exploitation process involves an attacker first making legitimate contributions to the repository to gain trust. They would then create a PR that combines a legitimate fix with malicious code. When this PR is marked for review by the public-facing agent, it can trigger a workflow that executes the malicious actions defined in the attacker’s PR.
Google’s Response and Mitigation
Google has addressed the underlying issue in the repository but has classified the exploit as non-rewardable due to its reliance on social engineering tactics. The company stated that while the vulnerability demonstrated the potential for a supply chain security compromise, it did not meet the criteria for a bug bounty payout. Google emphasized that PRs are not automatically merged, requiring a maintainer’s action to finalize any changes.
Implications for Security Practices
Lisichkin’s findings suggest that the current threat models may not adequately account for these new attack vectors introduced by AI agents. He advocates for enhanced threat modeling that considers agent identity and resource access to prevent such vulnerabilities. This incident serves as a reminder of the evolving landscape of cybersecurity risks associated with AI technologies.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
Original source: theregister.com
