A groundbreaking practical demonstration of an innovative attack method within a live multi-agent system showcases how one AI agent can exploit another to compromise software supply chains This article explores agents safe git. . The flaw was identified in Google's AdK-Python repository, which is responsible for Google’s Agent Development Kit for Python—a widely used SDK by developers to create their own AI agents.
This repository featured two tiers of automated agents: a low-privileged agent that interacted with public requests and issues via pull requests or issues, while a high-privileged agent was reserved for trusted maintainers who had real authority over the codebase. This attack method highlights significant vulnerabilities within multi-agent systems, demonstrating how even seemingly secure environments can be exploited by well-crafted attacks.
A command allowlist meant to restrict agents to safe "git" and "gh" operations could be bypassed using Git's scripting features like hooks and shell aliases, effectively granting remote code execution on the CI runner. PoC (Source: Pillar Security) The runner held long-lived personal access tokens and Google Cloud service account credentials, making it possible for an attacker to exfiltrate sensitive secrets from the pipeline simply by opening a GitHub issue. Enforce strict tool allowlists and preserve human guardrails like branch protection and mandatory code review to prevent a single compromised agent from leading to a full supply chain breach.
