Google removed three AI agent workflows from the ADK's Python repository This article explores provided adk_triage_agent google_api_key. . Pillar Security discovered that a public GitHub issue could influence a triage agent to activate a privileged code-fixing agent.
The team showcased the ability to execute arbitrary code on the CI runner, as well as the exfiltration of the bot's personal access token (PAT). For similar repositories, Pillar suggests using distinct bot identities, limiting token and tool scopes, and implementing an authorization mechanism that prevents untrusted input from generating unauthorized access. It authenticated with ADK_GCP_SA_KEY, provided ADK_TRIAGE_AGENT and GOOGLE_API_KEY to Google's Antigravity coding agent, and posted the generated analysis as a comment using the bot account.
A distinct workflow named issue-fix.yml monitors comments on /adk-issue-fix and restricts its execution only for authorized users—owners, members, or collaborators. These rights were assigned through the default GITHUB_TOKEN associated with the automated process, rather than using the ADK_TRIAGE_AGENT PAT that the task utilized. However, the script enabled CapabilitiesConfig(), which Google's Antigravity SDK documentation indicates turns on all tools, including writes.
Additionally, the report described an earlier chain that could create a false review trail through privileged Gemini workflows, though a maintainer was still required to merge the pull request. A check conducted by ZeroOwl on August 4, 2026, revealed that none of the three filenames existed in the repository's current main-branch workflow directory.
