# Google's AI Tool Witnesses First-Ever Agent-on-Agent Attack Researchers reveal how AI agents can manipulate each other in a production environment. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-08-03 - **Topic:** [Data & AI](https://brifing.si/c/data-ai) - **Original article:** - **On Brifing:** https://brifing.si/s/2eab6a38-7d63-495e-8854-18e7126dd465 ## First-Ever Attack Between AI Agents Pillar Security researchers discovered a critical vulnerability in Google's Agent Development Kit (ADK) for Python. This flaw allows one AI agent to control another and escalate privileges. ADK-Python is an open-source tool with over 90 million downloads used to build AI agents. Although Google has patched the issue, this incident highlights security risks between AI agents. ## Social Engineering-Triggered Exploit The attack occurs when a low-privilege AI agent triggers a high-privilege one via prompt injection. Attackers first need to make legitimate contributions to gain trust, then submit a malicious pull request (PR). Google stated this flaw didn't qualify for a bug bounty as it required social engineering. However, they've enhanced the repository's security. ## Step-by-Step Attack Execution The attack unfolds in two stages: First, the attacker creates a PR combining legitimate fixes with malicious code. Second, the low-privilege agent triggers the high-privilege one to execute the malicious payload. This process happens without human intervention, leaving a trail that appears as legitimate review activity. ## Google's Response and Clarifications Google confirmed fixing the vulnerability but deemed it ineligible for reward due to social engineering requirements. The company emphasized that PRs aren't auto-merged and require maintainer approval. They've nonetheless hardened the repository's security. Pillar's Dan Lisichkin will present findings at DEF CON. ## Identity and Access Management for AI Agents Lisichkin advocates for distinct identities for AI agents with clearly defined resource access permissions. In this attack, assigning a bot identity to the triage agent could have prevented most of the exploit. Security teams need to incorporate agent identity and resource access into threat models. ## Next-Generation Threat Modeling This incident revealed new attack surfaces impossible in the 'pre-agent' world. Lisichkin urges CISOs and security practitioners to model these scenarios and calculate worst-case impacts. As AI agents proliferate, such attacks are expected to increase in frequency and sophistication. ## The Ease of Prompt Injection Building this attack requires only English knowledge - attackers could even ask an AI to craft the prompt injection. This demonstrates how crucial security measures are for AI-based systems. Popular tools like Google's ADK could lead to large-scale vulnerabilities if not properly secured. ## A New Era in AI Security This discovery marks the first real-world attack between AI agents. As AI integration in software development grows, similar vulnerabilities will likely emerge. Companies must prioritize identity management and access control in AI systems. This event may signify the beginning of a new chapter in AI security. ## Sources covering this story - https://www.theregister.com/security/2026/08/03/google-dev-kit-spurs-first-ever-agent-on-agent-violence/5282496 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._