Google removed 3 AI agent workflows after a prompt-injection chain in ADK: why it is not safe to use

What happened

On August 4, 2026, The Hacker News reported that Google removed three GitHub Actions workflows from the `google/adk-python` repository after research from Pillar Security. The reported issue was a prompt injection chain. In plain language, prompt injection means hidden or untrusted instructions are placed inside content an AI reads, such as a public message or bug report.

According to the report, a malicious public GitHub issue could influence one agent and then trigger a second, more privileged maintainer-side agent. That matters because the second agent could take actions the human maintainer did not intend. The Hacker News said Pillar verified the workflows were gone on July 2, and Google confirmed the issue was fixed on July 21, 2026.

The repository was described as an open-source Python toolkit with more than 90 million downloads, which is one reason the finding received broad attention.

What it means for you

If you use an AI agent, treat messages, issues, pasted text, and web content as potentially untrusted. A normal-looking note can carry instructions meant for the agent, not for you. The risk is higher when one agent can hand work to another tool or agent with more access.

What to do instead

Keep agents on the smallest access they need. Do not let them take important actions automatically from public or unknown inputs. Review any action that touches code, files, accounts, or payments. Separate reading from doing when possible. Prefer skills and workflows that have been checked by a human. AgentPod lists only reviewed, tested skills, but you should still approve sensitive steps yourself.

Sources:

• https://thehackernews.com/2026/08/google-deletes-3-adk-ai-workflows-after.html
• https://www.theregister.com/security/2026/08/03/google-dev-kit-spurs-first-ever-agent-on-agent-violence/5282496