Google ADK agent-to-agent prompt injection exposed secrets and could poison pull requests: why it is not safe to use

What happened

On August 4, 2026, SecurityWeek reported research from Pillar Security on a weakness in Google ADK, a toolkit for building AI agents. In the reported setup, a lower-permission agent could be tricked into passing a malicious prompt, meaning hidden instructions, to a higher-permission agent.

The higher-permission workflow reportedly revealed which MCP tools it could use. MCP tools are connectors that let an agent call outside tools and services. Those exposed tools included broad bash access, meaning the ability to run shell commands on a system. The researcher said this created a path to remote command execution, which means running commands from afar, and possible token theft, meaning stealing access credentials.

The report said an attacker could potentially change comments, pull requests, and issues, dismiss reviews, approve pull request changes, and trigger other privileged Gemini workflows.

What it means for you

If you use Claude Code, Claude Cowork, or Codex, this is a practical example of prompt injection crossing trust boundaries. In plain terms, one tool or workflow with fewer permissions may be able to influence another that has more power.

What to do instead

Keep agent permissions as narrow as possible. Separate read-only tasks from write or admin tasks. Do not let one agent freely hand instructions to another with higher privileges. Review which tools an agent can see and use, especially shell access and tokens. Require human approval for actions that change code, reviews, or settings. Watch for unusual edits or workflow triggers. AgentPod lists only reviewed, tested skills, which can help reduce exposure, but you should still limit permissions and monitor sensitive actions.

Sources:

• https://www.securityweek.com/gemini-agent-to-agent-attack-exposed-secrets-enabled-pull-request-tampering/