threat-intel
Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent
High
Summary
Google removed three AI agent workflows from its ADK Python repository after a public GitHub issue allowed a malicious bot to trigger a privileged code-fixing agent, leading to potential code execution and credential exposure. The vulnerability stemmed from a misconfigured workflow that granted excessive permissions to a bot account, enabling it to manipulate code and access sensitive Google Cloud resources. Google has since patched the issue, but the incident highlights a critical risk in automated workflows and the importance of carefully controlling bot access.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data