🟠 High | Source: The Register — Security
Researchers have demonstrated the first known attack where one AI agent manipulates another via prompt injection hidden inside poisoned pull requests, using Google’s developer toolkit. A compromised or malicious code contribution can contain instructions that hijack an AI coding agent’s behaviour, potentially causing it to execute unintended actions on behalf of an attacker. This matters because it shows that agentic AI pipelines introduce a new class of lateral movement risk that traditional security controls are not designed to catch.
Security Architect’s Take: Review any CI/CD pipelines or developer workflows that use AI agents with access to code repositories — treat agent inputs such as pull request content as untrusted data and enforce strict output validation and sandboxing. Consider implementing policy guardrails that restrict what actions an AI agent can take autonomously, particularly around code execution, API calls, or secret access.
Original advisory: Google dev kit spurs first-ever agent-on-agent violence