Google's AI Coding Assistants Could Be Tricked Into Leaking Secrets and Sabotaging Code
A newly exposed attack technique shows how a low-level AI agent inside Google's development toolkit can be manipulated into poisoning a higher-trust agent, giving attackers a path to steal credentials and tamper with software projects.
Key points
- Researchers found a flaw in Google ADK, Google's toolkit for building AI-powered coding assistants, that lets attackers pass poisoned instructions between AI agents.
- A low-privilege agent (one with limited access) could be tricked into slipping a malicious command to a higher-privilege agent (one that can read secrets and modify code).
- The attack could expose stored credentials, such as API keys, which are passwords that let software talk to other software.
- Attackers could also use the method to tamper with pull requests, which are the proposed code changes developers submit for review before software ships.
- Google's ADK is used in developer and DevSecOps (development, security, and operations combined) workflows, meaning real codebases are in scope.
Software teams have spent years worrying about humans making mistakes with code reviews. Now there is a new problem: the AI assistants meant to help can be manipulated too.
Researchers disclosed a technique targeting Google ADK (Agent Development Kit), a software framework that companies use to build fleets of AI agents that work together on coding tasks. Think of ADK agents as a team of specialised robotic assistants. One might have read-only access to a project. Another might have permission to push code changes or read stored passwords.
How does the attack actually work?
The short version: a criminal crafts a sneaky instruction that rides inside a routine handoff message between agents, and the higher-trust agent follows it without question.
In a normal ADK workflow, a low-privilege agent finishes part of a task and passes a summary comment to a more powerful agent so it can carry on. The attack works by stuffing extra hidden instructions into that comment, a technique researchers call prompt injection (where attackers embed rogue commands inside text an AI is meant to read as ordinary content).
The higher-privilege agent sees the poisoned handoff and treats the attacker's instructions as legitimate work orders. From there, the agent could read API keys and other credentials stored in the project environment, or alter a pull request before a human developer reviews it. A change that looks safe on screen could contain malicious code underneath.
The failure mode here is a classic one dressed in new clothes: the more trusted component blindly trusted input from the less trusted one. First reported by SecurityWeek, the disclosure lands at a moment when AI coding assistants are being wired into production pipelines at serious speed.
Should developers be worried?
Yes, if they are running multi-agent ADK setups without strict input validation. In practice, many teams deploy these toolkits quickly and tune the guardrails later.
| Detail | Facts |
|---|---|
| Affected toolkit | Google ADK (Agent Development Kit) |
| Attack type | Prompt injection via agent handoff comments |
| What could be stolen | API keys, stored credentials |
| What could be tampered with | Pull requests (proposed code changes) |
| Affected workflow | Multi-agent AI coding pipelines |
For developers and engineering managers, the immediate question is whether any ADK agents in your pipeline pass unvalidated text between privilege levels. If they do, that handoff is an attack surface.
One thing the post-mortem will say: we assumed the agents were talking to each other, not to an adversary.
Operational takeaway: Treat every agent-to-agent message as untrusted input and sanitise it before a higher-privilege agent acts on it, the same way you would sanitise user input before writing it to a database.
