Reviewing Google's Agent Development Kit — the CI workflow that trusted the wrong identity

For a review, the useful frame isn't “is ADK secure” — it's that ADK is a fast-moving SDK with a large surface (a developer-facing builder endpoint, a bundled dev assistant, its own CI/CD automation) and each of those surfaces has, independently, had a real disclosure against it in 2026. None of the three findings below required a novel attack technique.

Security researchers Yarden Porat and Shahar Tal, disclosing 11 vulnerabilities across LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and ADK together at Black Hat 2026, put the underlying point directly: prompt-controlled content crossing into trusted framework logic is the actual defect class — not any single bug.

Notably, Google's first response to the unauthenticated dev-assistant finding was that it wasn't a bug. After the researchers pushed back, Google paid a bounty and issued a partial fix — worth knowing if a review is relying on “Google hasn't flagged this” as evidence something is safe by default.

This is part of a named cross-vendor pattern, “CoreBreak,” that also hit AWS Bedrock AgentCore (CVE-2026-18830) and the Vercel AI SDK (CVE-2026-64650/64651) — distinct from the Check Point-disclosed findings above, though both surfaced in the same general window. Redpanda's writeup on the pattern makes the review-relevant point directly: guardrails built to watch what a model says or does are irrelevant to an attack that never involves the model executing at all. A tool-confirmation mechanism has to validate the tool call itself, independent of whatever produced it.

The GitHub Action finding is worth walking through on its own, because the entry point required nothing more privileged than commenting on a public issue. ADK's own repository ran automation where a lower-privileged triage bot could, on seeing the right trigger text, post a command that kicked off a separately-privileged code-fixing workflow — one with write access to issues, repository contents, and pull requests. Prompt-injected text in a public issue was enough to get the triage bot to post that trigger, and the privileged workflow never checked where the triggering content had actually originated. Google confirmed a fix on July 21, 2026, and had deleted the three vulnerable workflow files by August 4.

The pattern generalizes past ADK's own repository: any CI/CD automation that lets a lower-trust actor (an issue commenter) indirectly trigger a higher-trust action (a privileged workflow) through an intermediate bot is the same shape of mistake, and it's worth checking for in any organization's own agent-adjacent automation, not just ADK's.

Agent Gateway moves identity management, mTLS handshakes, policy enforcement, and payload auditing out of individual agent code and into shared network infrastructure, covering both Client-to-Agent (ingress) and Agent-to-Anywhere (egress, including agent-to-tool calls) traffic. It uses mTLS plus Demonstrating Proof-of-Possession (DPoP) for cryptographic identity verification and integrates with IAM and Model Armor for layered policy — a genuinely more specific architecture than “a policy-enforcement point” suggests, and one worth confirming is actually in the traffic path rather than bypassed.

ADK's Callbacks fire at defined points in the execution lifecycle — before_agent (authorization and maintenance checks), before_model/after_model (guardrails, request rewriting, PII stripping from responses), and before_tool/after_tool (argument validation, rate limiting, result logging). A callback can return an object to override or block an operation outright. Google's own guidance, citing OWASP's ranking of indirect prompt injection as the top LLM application risk, is to use before_tool/after_tool hooks specifically to sanitize inputs and validate tool responses before they re-enter model context — a specific, checkable recommendation, not a general security platitude.

For any system built on Google ADK, a design-time review should be able to answer:

• Is the ADK-for-Python package pinned past version 1.22.0, where CVE-2026-79707 was fixed?
• Is the bundled development assistant's HTTP API reachable from anywhere other than localhost in any deployed environment?
• Does any internal CI/CD automation let a lower-privileged bot or process trigger a higher-privileged workflow based on content from an untrusted source (an issue, a comment, a PR title)?
• Is the “Agent Gateway” pattern actually deployed as a policy-enforcement point, or is it a documented option the deployment never adopted?
• Is ADK for Python pinned past 2.5.0, closing the CoreBreak tool-confirmation forgery (CVE-2026-18236)?
• Do before_tool/after_tool callbacks actually sanitize inputs and validate responses, per Google's own indirect-prompt-injection guidance, or is that hook point unused?

See tool-use permission scoping for the general pattern behind the path-traversal and unauthenticated-endpoint issues that recur across most agent frameworks, not just this one.