Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering

A crafted prompt to a low-privilege Google ADK agent could be used to pass a malicious hand-off comment to a privileged agent. SecurityWeek reported that this Gemini agent-to-agent attack method exposed secrets and enabled pull request tampering. The path did not require direct access to the higher-privilege agent; the attacker worked through the weaker peer that was allowed to hand work off.

In multi-agent setups built on Google ADK, a lower-privilege agent can receive user or external input and then hand off a comment or task payload to a higher-privilege peer. The attack used that hand-off as the trust boundary: a crafted prompt shaped the comment so the privileged agent treated it as a legitimate internal hand-off rather than untrusted input. Once accepted, that comment could drive privileged actions, including exposure of secrets and pull request tampering.

For engineers building agent pipelines, the risk is structural. Privilege is only as strong as the validation on every hand-off. If a low-privilege agent can inject free-form comments into a privileged agent’s context, prompt injection becomes an authorization bypass. Teams that treat inter-agent messages as trusted internal traffic inherit the same failure mode SecurityWeek described.

That pattern sits in a broader shift toward multi-agent orchestration, where tools chain agents with different scopes for code review, PR edits, and secret access. Competitively, any platform or framework that ships agent-to-agent hand-offs without hard policy on what a privileged agent may accept from a peer faces the same class of abuse. SecurityWeek’s report puts Google ADK and Gemini multi-agent flows under that lens, not as abstract model risk but as concrete PR and secret impact.

Practical next steps: treat every agent hand-off as untrusted input; strip or schema-validate comments before a privileged agent acts on them; and keep secret material and pull-request write access off any agent that can be reached through a low-privilege peer. Watch for hardening of Google ADK hand-off APIs and for similar agent-to-agent injection findings that target privileged tool use rather than a single chat session.