Gemini agent-to-agent attack exposes secrets and enables pull request tampering

Pillar Security published research on August 3, 2026, detailing a novel attack against Google’s open-source Agent Development Kit for Python, specifically targeting workflows inside the gemini-cli GitHub repository. The exploit works by injecting malicious instructions into a low-privilege AI agent, which then triggers a more powerful, maintainer-only agent, pulling off what researchers are calling the first real-world instance of one AI agent compromising another with elevated privileges. The gemini-cli repository has logged over 90 million downloads. How the attack actually works The attack chain begins with a public GitHub issue or pull request laced with a prompt injection payload. Gemini-cli uses AI agents for routine tasks like issue triaging and pull request review, and these agents operate at different privilege tiers. The low-privilege agent, the one anyone can interact with by filing an issue, gets manipulated first. That agent then inadvertently triggers the maintainer-level agent, which carries far more authority. Those actions include exfiltrating GitHub tokens that carry pull-request write permissions. With those tokens, an attacker could submit deceptive pull request...