Researchers found that the github-actions bot could be deceived into submitting an approving review for a malicious pull request through command injection. This discovery by security analysts highlights a fundamental shift in how vulnerabilities manifest within decentralized, AI-driven development environments. As organizations currently adopt the Google Agent Development Kit (ADK) to streamline repository management and code reviews, they inadvertently introduce complex layers of “agent-to-agent” exploitation risks. These systems are designed to operate autonomously, often possessing the ability to interact with external inputs from unverified sources. When an automated agent treats a public comment or a pull request description as a trusted instruction, it creates a direct pathway for attackers to subvert the intended logic of the workflow. The implications of these flaws extend beyond simple code changes, as they expose the underlying infrastructure to unauthorized access and potential data exfiltration within modern cloud-based ecosystems.
Breaking Down Multi-Step Exploitation Paths
Prompt Injection: The Bridge to Privilege Escalation
The first major vulnerability involves a triage agent responsible for managing repository contributions through a collaborator-level account. This specific agent is programmed to categorize issues and direct pull requests to the appropriate developers, making it a central hub for repository activity. Attackers can embed hidden prompt injection instructions within a public pull request that force the agent to execute specific commands, such as triggering a more privileged “gemini-cli” workflow. Because the triage bot operates under the assumption that metadata within a pull request is benign, it lacks the necessary validation layers to distinguish between a valid task and a malicious directive. This absence of semantic sanitization allows an external actor to effectively hijack the agent’s decision-making process. By manipulating the instructions the agent receives, the attacker shifts the boundary of control from the repository maintainer to a rogue prompt, setting the stage for further escalation.
Once the secondary “gemini-cli” process is activated, the attacker gains the ability to manipulate the Continuous Integration (CI) environment with surprising efficiency. Although the bot cannot push code directly to protected branches, it can manufacture fraudulent “approving reviews” and delete maintainer comments, effectively tricking human reviewers into merging malicious code. This manipulation of the social and technical trust within the GitHub ecosystem is particularly dangerous because it bypasses the standard peer-review safety net. The agent’s high-level access allows it to simulate a consensus among contributors, making a malicious contribution appear as though it has undergone rigorous verification. Furthermore, by silencing legitimate warnings or maintainer feedback, the compromised agent creates a vacuum of information where security oversights are likely to occur. This tactical use of “agent-to-agent” interaction demonstrates that even limited bots can provide a substantial foothold if they are capable of interacting with more powerful system utilities.
Compromising Cloud Credentials: The Critical Failure Point
A second, more severe attack vector targets workflows designed to automatically fix repository issues using specialized agents that utilize the Google ADK framework. In this scenario, a malicious prompt placed in a standard GitHub issue can convince an analysis agent to launch a “fixing workflow” that was intended only for trusted users or internal maintenance tasks. By exploiting the underlying Git commands within this environment, researchers demonstrated that an attacker could achieve arbitrary code execution by including shell-sensitive characters in their prompts. The automated nature of these “fixing agents” often requires them to run in environments with higher permissions than standard triage bots, as they must be able to branch code and run diagnostic tests. When these agents are exposed to unauthenticated external input from an issue tracker, the entire security perimeter of the repository is brought into question. The fluidity of these workflows creates a situation where a simple text-based comment can be transformed into a lethal command sequence.
The investigation concluded that the theft of personal access tokens and Google Cloud service account keys led to a total compromise of both the repository and the associated cloud infrastructure. To prevent such breaches, security teams identified that a transition from simple asset inventory to sophisticated delegation mapping was required to secure autonomous environments. Experts recommended the implementation of rigorous tracing for untrusted inputs and the hardening of handoffs with out-of-band authentication checks that prompt injection could not bypass. Furthermore, organizations maintained independent, read-only logs of all repository actions to prevent agents from deleting evidence of their activities. By enforcing authenticated review cycles where any post-approval code change invalidated the previous status, companies ensured that human oversight remained a robust final line of defense. These strategic defenses established a new standard for securing multi-agent systems, prioritizing the isolation of privileged credentials and ensuring that automated logic remained tethered to strictly verified human authorization.
