Gemini agent flaw exposed secrets, enabled PR tampering

Pillar Security reported that a vulnerability in Google’s Agent Development Kit (ADK) for Python allowed a public-facing agent to trigger a privileged agent and expose repository secrets. Researcher Dan Lisichkin discovered the issue and notified Google in early June.

The ADK repository separated agents into low-privileged agents that interact with users and high-privileged agents intended for maintainers. Lisichkin observed an automated triage bot commenting on pull requests with the repository Collaborator role, which gives it elevated permissions. He found a way to make the public agent post an @gemini-cli-style prompt as a PR comment, which triggered the gemini-invoke workflow.

The gemini-invoke workflow response was returned via the MCP server and revealed the privileged agent’s available tools. The response showed the bot could execute arbitrary bash commands, creating a path to remote code execution and to extract the agent’s GitHub token. With that token and shell access, Lisichkin demonstrated the ability to edit comments, modify pull requests and issues, dismiss or approve reviews, and run gemini-invoke and gemini-review against any PR.

Lisichkin outlined how an attacker could combine those actions to create a believable approval trail for a malicious PR while noting the final merge would still require a repository member’s action. He wrote: “Editing the triager’s comment uses the impersonation primitive from issues: write; posting and approving as the bot uses the RCE-extracted GITHUB_TOKEN; the label and review-request changes fall under pull-requests: write. Strung together, they manufacture a complete, believable ‘a human asked for a review, Gemini ran it, Gemini approved’ trail on the poisoned PR, none of which ever happened.”

Google applied hardening measures after the report. Pillar later reported a second vulnerability in the repository’s Antigravity-SDK-based agent automation that could have allowed remote code execution without maintainer interaction; Google fixed that issue in late July. Google declined to issue a bug bounty for the initial agent-to-agent finding, citing the need for social engineering to obtain a merged malicious PR.

Pillar’s disclosure highlights the risk when lower-privilege automation can influence higher-privilege components and the need to limit workflow exposure to tokens and command execution. The immediate attack vectors reported were addressed by Google’s fixes.