Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Google ADK Python repository workflow prompt-injection security flaw

Vulnerability
First reported
Last updated
Happening score
H score 34
1 unique sources, 1 articles

Summary

Hide ▲

Google's ADK Python repository workflows had a prompt-injection flaw that let a public GitHub issue steer a trusted triage bot into a privileged code-fixing path. Researchers showed the chain could reach the CI runner, execute arbitrary code, and expose the bot PAT and cloud credentials. Google removed issue-analyze.yml, issue-fix.yml, and pr-analyze.yml after the proof of concept; the record does not show in-the-wild exploitation.

Related Happenings

Google Dialogflow CX Code Blocks shared-runtime isolation security flaw

Vulnerability
H score32 First: 07.07.2026 19:37 Last: 07.07.2026 19:37 Sources 1

About this happening: Google Dialogflow CX Code Blocks had a shared-runtime isolation flaw that could let one editable agent affect other Code Block-enabled agents in the same Google Cloud pr...

Open Happening

CI/CD pull-request privilege-escalation flaw (Cordyceps)

Vulnerability
H score32 First: 24.06.2026 15:48 Last: 24.06.2026 15:48 Sources 1

About this happening: Cordyceps exposed a CI/CD workflow privilege-escalation flaw in pull-request automation that let unauthenticated users hijack privileged workflows and reach open-s...

Open Happening

Shai-Hulud worm clone activity on NPM

Malware Activity
H score69 First: 18.05.2026 12:45 Last: 18.05.2026 12:45 Sources 1

About this happening: The Shai-Hulud malware activity has continued to evolve across the npm supply chain and related developer ecosystems. It first infected npm packages in September 202...

Open Happening

Google Antigravity critical prompt-injection RCE flaw

Vulnerability
H score28 First: 21.04.2026 13:52 Last: 21.04.2026 13:52 Sources 1

About this happening: Google fixed a critical Antigravity flaw that let a prompt injection bypass Secure Mode and escalate to sandbox escape and remote code execution (RCE). The...

Open Happening

Langflow missing-authentication code-injection flaw (CVE-2026-33017)

Vulnerability
H score55 First: 20.03.2026 17:15 Last: 20.03.2026 17:15 Sources 1

About this happening: Langflow's CVE-2026-33017 is being actively exploited to deliver a Monero miner through exposed AI application endpoints. The campaign uses unauthenticated R...

Open Happening

Timeline

  2. 04.08.2026 14:16 2 articles · 2h ago

    Google removes three ADK workflow files from the repository

    Mitigation Patch Update

    Google removed issue-analyze.yml, issue-fix.yml, and pr-analyze.yml from the Agent Development Kit (ADK) Python repository after the workflows processed untrusted issue and pull-request content with broad repository credentials.

    Show sources
    Open in new tab
  5. 04.08.2026 14:16 1 articles · 2h ago

    Public GitHub issue can prompt-inject a privileged ADK code-fixing agent

    Initial Disclosure

    Pillar Security disclosed that a public GitHub issue could prompt-inject a triage agent into triggering a privileged code-fixing agent, enabling arbitrary code execution on the CI runner and exposure of the bot personal access token, Google API key, and Google Cloud service-account credential.

    Show sources
    Open in new tab