One AI agent convinced another to execute hacker commands — dangerous attack scheme found in Google SDK

In the repository of Google's Python development kit, researcher Dan Lisichkin from Pillar Security discovered a vulnerability that allows a hypothetical attacker to compromise software at the supply chain level by manipulating a highly privileged AI agent through malicious requests to a less privileged public AI agent. The attack scheme abuses the interaction mechanisms between AI agents. In the Google repository, there are two agents: the first, public one, analyzes user inquiries and new merge requests; the second, accessible only to project maintainers, has broader permissions. The first can delegate tasks to the second, and this transfer is considered trusted. To carry out the attack, the attacker first submits a benign code fragment to gain trust and the ability to run certain processes at the AI agent level. In the second stage, they submit another merge request with malicious instructions embedded in the description for the public agent. The public agent interprets them as part of its task and calls the privileged AI agent, passing it a trusted message. The second agent then gains the ability to perform actions that a normal user could never run directly. This is not a software vulnerability in the traditional sense, but a problem of the trust chain between agents: GitHub Actions mechanisms are public, and anyone can analyze how they interact. Google, however, refused to pay the researcher a bounty, arguing that even with a token with 'pull-requests: write' permissions, code is not included automatically but by the will of a human maintainer. The company strengthened workflow protections and listed the researcher as a co-author of the fix. The researcher insists that Google closed only one implementation of the vulnerability, not the underlying problem. It is not enough to harden workflows or isolate AI agents from each other: agents must be identified and have fixed sets of permissions, similar to access control for humans. He urges including AI agents in threat models, as they are potential attackers in workflows.