I'll just call you — Agent-to-Agent Privilege Boundary Failures in CI/CD Agents

Abstract

AI agents are no longer just running in local environments. They are already showing up inside real CI/CD cycles, wired into issue triage, PR review, repository maintenance, and user discussion workflows. In Google’s `adk-python` repository, we found exactly that: agentic workflows triaging issues, pull requests, and discussions.

These agents were susceptible to prompt injection from attacker-controlled repository content. In first glace, the impact looked almost boring: an attacker could make the agent output attacker controlled text as comments inside PRs and issues. So what? Who cares if an agent comments what we tell it to?

The answer is that this comment was not just text. In the same repository, Google had also interloped Gemini based workflows capable of taking actions against the repository, including code review like behavior and other automation, gated by author or trigger conditions. The ADK-based agents, meanwhile, were wired with highly privileged personal access tokens. That meant an attacker could prompt inject one agent into posting something like `@gemini-cli`, causing another agentic workflow to wake up and begin performing actions.

This poster presents what we believe is one of the first documented agent-to-agent paths toward potential software supply-chain compromise. We will show how the issue was found, how the exploit chain was developed, why the English language is another form of command execution interface, and how impact analysis changed the severity of the finding. We will also cover remediation steps and broader lessons for securing agentic CI/CD systems before agents start triggering agents all the way down.