Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent

Google removed three AI workflows from its Agent Development Kit repository due to a security issue. Researchers at Pillar Security discovered that a public GitHub issue could be manipulated to trigger a privileged agent. The issue allowed a public agent to be injected with a prompt, causing it to post a comment that satisfied a collaborator bot. This bot was identified as adk-bot and could be triggered to post /adk-issue-fix. The vulnerability was addressed by Google deleting the affected workflows.