Google Removes ADK AI Workflows After Malicious GitHub Issue Exposes Privilege Escalation Risk

Google has removed three workflows from its Agent Development Kit (ADK) after a security researcher demonstrated that a maliciously crafted GitHub issue could trigger a privileged agent, potentially leading to unauthorized code execution. The ADK is a framework used by developers to build and manage AI agents, and these workflows are automated processes that handle tasks like issue triage and pull request analysis. The incident underscores the dangers of integrating external inputs into automated systems without rigorous validation.

The vulnerability stemmed from the way the workflows processed GitHub issue submissions. By submitting a specially crafted issue, an attacker could manipulate the agent to run commands with elevated permissions. This type of privilege escalation could allow a threat actor to access sensitive data, modify repository settings, or even pivot to broader infrastructure. The malicious workflow did not require authentication beyond the ability to open an issue, making it a low-barrier attack vector for public repositories.

For businesses and website owners, this serves as a reminder that supply chain attacks can originate from unexpected sources. Even if your own code is secure, dependencies and third-party tools like AI agents introduce new risk surfaces. A compromised development pipeline can lead to website defacements, data breaches, or unauthorized access to hosting environments. Regular auditing of all automated processes and strict input sanitization are critical, especially when dealing with AI-driven systems that may have opaque decision-making paths.

This event highlights why continuous security assessment and expert guidance are vital. AEU-I offers security-first infrastructure and consulting services that help businesses identify and mitigate such emerging threats. By hardening development environments and monitoring for anomalous behavior, organizations can reduce the likelihood that a novel vulnerability turns into a full-scale breach.