GitHub issue could hijack Google's AI tools

Published July 23, 2026

Google's own AI bots that help manage its adk-python project on GitHub could be tricked into faking their work. Researchers showed a public-facing bot could be manipulated into making a more trusted bot post fake code review approvals, and a related flaw let an attacker try to run extra commands on Google's build server just by opening a GitHub issue.

Report priority
Medium
Targets
Google+4 more

How it works

An attacker leaves a pull request comment worded like a normal contribution note, but hidden inside it are instructions that trick Google's public triage bot into posting a message that fires off a more trusted review bot using a real maintainer-linked account, so GitHub treats the trigger as coming from a trusted human instead of a bot.

What to do

Teams running their own AI coding agents on public repos should instead check whether those agents post or merge using a personal collaborator account rather than a narrowly scoped bot identity.

Anyone running similar AI agents should give them scoped, auditable bot identities instead of personal access tokens, restrict which commands they can run, and keep human code review and branch protection turned so no single agent can approve or merge code alone.

Technical details

Affected software: Google, adk-python, Agent Development Kit, Gemini CLI, Antigravity SDK

An attacker opens a pull request against Google's adk-python project and leaves a comment that reads like an ordinary contribution note. Hidden text in that comment tricks the project's public triage bot into posting a reply starting with the review bot's trigger phrase, using a real collaborator account instead of a limited bot identity. GitHub treats this as a trusted human action, so the higher-privileged review bot posts a convincing approved mark on the pull request without any person actually checking the code.

The chain started with adk_pr_triaging_agent, a public bot tied to a real collaborator account rather than a scoped identity. Prompt injection in a pull request comment made it post a message that triggered the gemini-invoke and gemini-review workflows as if a trusted maintainer had done so, yielding a token that could edit comments, impersonate maintainers, and post fake approved review marks. Days later, new Antigravity SDK automation in the same repo let an attacker bypass a git/gh command allowlist using git hooks and shell aliases, reaching a CI runner that held a long-lived personal access token and Google Cloud service account credentials.

References

View Original Source