In the world of cybersecurity, an event has occurred that could revolutionize approaches to protecting corporate systems. Specialists at Pillar Security discovered a fundamentally new type of cyberattack, dubbed "Agent-to-Agent." The vulnerability was found in the Google ADK (Application Development Kit) repository and allows attackers to use a low-privilege AI bot to manipulate a bot with high-level access rights.
A New Threat Vector: From Theory to Practice
The discovery was made by security expert Dan Lisichkin. According to him, the emergence of such attacks indicates a significant expansion of threat surfaces. In the "pre-agent" era, such attack vectors simply did not exist, placing Chief Information Security Officers (CISOs) under the necessity of urgently revising their threat prevention models.
The core of the problem lies in the incorrect isolation of two classes of automated AI agents. Despite having different access levels, they shared a common trust boundary. This created a loophole through which a hacker could jump from a low privilege level to a high one.
Hacking Mechanics: How It Works
The attack is executed using prompt injection technology—the insertion of malicious instructions into a text prompt. The attacker forces a public bot to generate a specific system command tag, for example, @gemini-cli.
The key aspect of the vulnerability lies in how the system interprets this request. Since the public bot was recognized by the system as an account with Collaborator (employee) rights, the tag generated by it was interpreted as a legitimate request from a developer.
As a result, a high-privilege bot was activated, which began performing actions within the CI/CD environment. Specifically, it could read access tokens and modify code comments, opening the path to the compromise of critical infrastructure.
Google's Position and Expert Reaction
The American tech giant promptly fixed the identified vulnerability in its repository. However, the company refused to pay a reward to the researcher under the Bug Bounty program. Google explained its decision by stating that for a successful attack execution, the attacker would still require elements of social engineering and final confirmation by a human (maintainer).
Nevertheless, experts at Pillar Security disagree that this makes the attack safe. They emphasize that simple isolation of assistant execution environments is no longer a sufficient security measure.
The Future of AI Security
Specialists insist on transitioning to a new security paradigm. Every AI agent must possess its own strictly limited digital identity (Agent Identity) and clearly defined access rights to resources. Only such an approach will make it impossible to use one bot to bypass the authorization of another.
