An agent anyone could talk to just pulled the levers on one almost nobody could reach — and it happened inside the crown jewels: a live code repository.
Google gave its AI agent human-level trust — and paid for it.
When Dan Lisichkin, a researcher at Pillar Security, started mapping every Google repository running an embedded coding agent, he wasn't hunting for prompt injection — he was hunting classic CI/CD bugs. The AI angle showed up almost by accident, flagged by his own automation. What he found inside Google's Agent Development Kit repository was a low-privilege issue-triaging bot commenting on GitHub *as a trusted collaborator* — a status that should be reserved for humans the maintainers know. As Dan puts it, describing the moment his manager pushed back on downplaying the find: *"this is an agent triggering another agent... this is like no one talked about this before."*
The prompt injection wasn't the hard part — weaponizing it was.
Dan walks through Pillar's CFS framework (Context, Format awareness, instruction Salience) and how he literally used Google's own CONTRIBUTING.md file as the blueprint for the injection that would slip past the triage agent undetected. From there, one gated comment — normally reserved for trusted maintainers — was enough to trigger a second, far more privileged agent.
This isn't a bug you patch once — it's a new attack surface.
Dan's read is blunt: multi-agent systems create "weird machine" behavior — undefined states nobody designed for, not flaws in a specific line of code. He and Justin dig into why bolting more rules onto a non-deterministic system is Sisyphean, why bot identities need database-row-level granularity instead of human-style trust, and why Dan — a former malware researcher — thinks mandatory human-in-the-loop is often the wrong answer at scale.
Chapters:
00:00: Cold Open: The Agent That Wasn't Supposed to Talk**
- Google's public triage bot and the collaborator-status anomaly
- Why "an agent triggering another agent" had never been formally described before
04:12: Building the Hunt: Automation Over Manual Bug-Hunting**
- Dan's CI/CD vulnerability scanner, built on top of Claude Code
- How an AI-generated "AI agent injection" tag became the whole story
- Reference: [Simon Willison — "The Lethal Trifecta for AI Agents"]
14:30: The Exploit: Contribution Guidelines as an Attack Roadmap**
- Google ADK repository, the PR-triaging agent, and the CONTRIBUTING.md file used as a weapon
- Pillar Security's CFS framework for indirect prompt injection (Context, Format awareness, Salience) — [Pillar Security Blog: Autonomy of Indirect Prompt Injection]
- Why jailbreaking ≠ what Dan is doing — "I'm not trying to break the wall, I'm trying to walk through the door it left open"
28:05: Impact: Two Bugs, Two Verdicts**
- GitHub token exfiltration, PR/issue metadata manipulation, and the fake "looks good to merge" trail
- The second bug: a GCP service account and code-execution potential — "there was more juice on that one"
- Why Google didn't pay a bounty — and why that answer is more interesting than the bug itself
38:50: Identity, Granularity, and the Human-in-the-Loop Debate**
- Why bot identities need GitHub App/Actions scoping, not personal-access-token trust
- The case *against* blanket human-in-the-loop — review fatigue, OpenClaw, and "people are going to do this anyway"
- SolarWinds, CryptoLocker, and why Dan thinks this is a closed-gap problem, not an open one
Resources:
Lisichkin, D. (2026, August 3). I'll just call you: Agent-to-agent privilege boundary failures in CI/CD on Google's ADK repository. Pillar Security. https://www.pillar.security/blog/ill-just-call-you-agent-to-agent-privilege-boundary-failures-in-ci-cd-on-googles-adk-repository
https://danusminimus.github.io/
#aiagents #security #promptinjection #google #defcon #vulnerability