Gemini agent-to-agent attack exposes secrets and enables pull request tampering

Pillar Security published research on August 3, 2026, detailing a novel attack against Google’s open-source Agent Development Kit for Python, specifically targeting workflows inside the gemini-cli GitHub repository. The exploit works by injecting malicious instructions into a low-privilege AI agent, which then triggers a more powerful, maintainer-only agent, pulling off what researchers are calling the first real-world instance of one AI agent compromising another with elevated privileges.

The gemini-cli repository has logged over 90 million downloads.

How the attack actually works

The attack chain begins with a public GitHub issue or pull request laced with a prompt injection payload. Gemini-cli uses AI agents for routine tasks like issue triaging and pull request review, and these agents operate at different privilege tiers. The low-privilege agent, the one anyone can interact with by filing an issue, gets manipulated first. That agent then inadvertently triggers the maintainer-level agent, which carries far more authority.

Those actions include exfiltrating GitHub tokens that carry pull-request write permissions. With those tokens, an attacker could submit deceptive pull requests that appear to carry legitimate AI review approvals, a supply chain poisoning scenario that would be extremely difficult to detect in fast-moving CI/CD pipelines.

Pillar Security released this research as part of a series it calls the “Week of Sandbox Escapes.” Google moved quickly to patch the underlying bug, but declined to issue a bug bounty reward, citing the attack’s reliance on social engineering as the reason it fell outside bounty criteria.

Why this is a bigger deal than one patched bug

What’s new here is the agent-to-agent escalation: one AI system being used as a stepping stone to compromise a more privileged one. Trust hierarchies between agents can be exploited just like trust hierarchies between human users in traditional privilege escalation attacks.

The gemini-cli case targets a CI/CD pipeline, the automated infrastructure that builds, tests, and deploys software. Compromising that layer doesn’t just affect one repository—it affects every downstream project and user that depends on software built from tainted code.

What investors and developers need to watch

The Pillar Security researchers specifically called for organizations to rethink their security architectures to include distinct agent identities, tighter access controls, and threat models that account for agent-to-agent interactions.

Agents operating in shared repositories interact with content submitted by the public, which is functionally equivalent to letting untrusted input flow directly into privileged systems. Fixing that requires rethinking how agents are deployed, not just patching individual vulnerabilities.