Google Deleted 3 ADK Workflows After an Agent-to-Agent Injection in CI/CD

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.

On August 4, 2026, Google deleted three GitHub Actions workflows from google/adk-python — the repository behind the Agent Development Kit for Python, an SDK many teams use to build their own agents — after Pillar Security demonstrated that a public GitHub issue could trigger a privileged agent and reach code execution on a CI runner. The exploit, dubbed "I'll Just Call You," was not an exotic memory-corruption bug. It was an agent-to-agent privilege boundary failure: the workflow delegated work to an ADK agent, used issue content as the agent's input, and the model interpreted attacker-controlled text in that issue as instructions. The latest AI news desk has tracked the summer's agent-security incidents; this one is the clearest case study yet of why agent inputs are never just data.

The exploit chain

The attack is elegant because it reuses the platform's own design. The ADK workflows were built to react to GitHub events — including new issues — by spinning up an agent to do useful work: triage, labeling, maybe drafting responses. Pillar Security found that by opening a public issue containing carefully crafted text, an attacker could:

1. Trigger the workflow — the issue event fires the GitHub Actions workflow.
2. Deliver instructions inside the issue body — the workflow passed the issue content to the ADK agent as input.
3. Steer the privileged agent — the model read the attacker's text not as data about a bug report but as instructions, including steps that reach code execution on the CI runner.
4. Execute with the workflow's privileges — the agent ran with the permissions and secrets attached to the GitHub Actions job, which are far above what any external contributor should hold.

Google's response was fast and correct: it removed the three workflows. But the pattern is the lesson — and it is everywhere.

Why agent-to-agent boundaries fail

A privilege boundary in traditional systems is enforced by data being inert: a web form is data, a JSON payload is data, and the receiving code decides how to interpret it. Models break that assumption. For a model, input is not inert — text is both data and instructions, and the model cannot reliably distinguish the two. The classic example is prompt injection in a web page read by an agent; the ADK incident is the same failure in a different wrapper: a GitHub issue read by a privileged agent.

The deeper problem is that this is not a bug you can patch with a better model. It is a structural property of how models consume text. Any message crossing a trust boundary — an issue, a PR description, a web page, an email, another agent's reply — can carry instructions for the receiving agent. The boundary holds only if the system treats cross-boundary content as untrusted data and never as instructions. The AI workflows library has been documenting this exact discipline under the label of input provenance: know where every token came from before the agent acts on it.

The CI/CD agent hardening checklist

The ADK incident maps to a concrete hardening checklist for any agent wired into CI/CD:

1. Treat issue and PR content as untrusted data. Parse it as structured fields (title, body, labels), and never let raw markdown flow into an agent as free-form instructions. Strip or quote external content before it reaches the model.
2. Scope agent credentials to least privilege. The agent should hold only the permissions the workflow needs — never ambient repo-admin or secret-access rights. The damage in the ADK case scaled with the workflow's privileges.
3. Separate runner contexts. External-triggered work (issues, PRs) should run on unprivileged runners or sandboxed containers, with privileged operations reserved for maintainer-approved paths.
4. Validate tool arguments. Before the agent's tool calls execute, validate the arguments against allowlists — which files, which commands, which branches.
5. Require human approval for privileged actions. Any action that reaches code execution, merges, or publishes should require an explicit human gate. This is the same human-in-the-loop pattern the AI workflows library prescribes for high-impact agent actions.

The broader A2A lesson

The ADK incident is usually described as prompt injection, but the sharper framing is agent-to-agent (A2A) trust boundaries. The workflow was, in effect, one agent (the CI process) calling another (the ADK agent) with attacker-influenced content. Every A2A integration has the same property: the caller's message is the callee's instructions. Whether the caller is a GitHub Actions workflow, another microservice agent, or an external system, the receiving agent cannot be allowed to blindly trust the message.

The mitigation is provenance plus separation: the receiving agent should know the provenance of each input segment (this came from an external issue; this came from a trusted config) and apply different trust levels accordingly. Inputs from outside the trust boundary should be quoted as data, never interpreted as instructions. This is the same discipline the MCP directory applies to tool surfaces — every tool is a boundary, and every boundary needs a policy.

What teams should do now

1. Audit your CI/CD agent workflows. Find every workflow that ingests external content (issues, PRs, comments, webhooks) into an agent. Assume each one is exploitable until proven otherwise.
2. Strip instructions from external content. Parse and quote external text before it reaches the model. This one change neutralizes the ADK attack class.
3. Drop privileges. Agents triggered by external events should run with the minimum credentials and in isolated contexts.
4. Gate privileged actions. Code execution, merges, and publishes require a human approval step.

The bottom line

Google deleting three ADK workflows is a small patch to a big lesson: in agentic systems, input is instructions. Any content that crosses a trust boundary — a GitHub issue, a web page, another agent — can steer the receiving agent, and the damage scales with the privileges you gave it. The fix is architectural: treat external content as untrusted data, scope credentials, isolate contexts, and require human gates for privileged actions. Build the trust-boundary discipline from the AI workflows library before a public issue calls your most privileged agent. Track the incident wave on latest AI news.

Frequently Asked Questions

What happened with Google's ADK workflows?

On August 4, 2026, Google removed three GitHub Actions workflows from google/adk-python after Pillar Security showed a malicious public GitHub issue could trigger a privileged agent and reach code execution on a CI runner.

What was the exploit technique?

Agent-to-agent privilege boundary failure: the workflow delegated to an ADK agent using issue content as input, and attacker-controlled text in the issue was interpreted by the model as instructions — effectively calling a privileged agent.

Why do agent-to-agent boundaries fail?

Because model input is not inert data: a model treats text as instructions, so any message crossing a trust boundary — a GitHub issue, a web page, an agent reply — can steer the receiving agent.

How should CI/CD agents be hardened?

Treat issue and PR content as untrusted data, scope agent credentials to least privilege, run agents in isolated contexts, validate tool arguments, and require human approval for privileged actions.

Is this a vulnerability in Google's ADK itself?

The flaw was in the workflows' design, not the SDK core: the workflows trusted cross-boundary content as agent input. Google removed the workflows, and the lesson applies to any agent wired into CI/CD.

Closing thoughts

The ADK incident is the textbook case of an A2A privilege boundary failure: attacker-controlled text in a public issue steered a privileged agent into CI code execution. The patch is architectural, not model-level — treat every cross-boundary input as untrusted data, scope credentials, isolate contexts, and gate privileged actions. The patterns are in the AI workflows library, and the running incident coverage is on latest AI news."