Google ADK Flaw Let Low-Privilege AI Agent Trigger Privileged CI Workflows via Prompt Injection

·1 views

Security firm Pillar Security disclosed on August 3, 2026, a high-severity attack chain targeting Google's open-source Agent Development Kit (ADK) for Python on GitHub. An external attacker could embed a prompt injection inside a pull request body, manipulating a low-privilege PR triage agent into posting a comment under a trusted collaborator's identity. Because Google's gemini-dispatch workflow granted trust based on the commenter's identity rather than the origin of the content, it automatically triggered high-privilege Gemini CI workflows with broad runner access. Through the resulting runner execution and a leaked GITHUB_TOKEN, an attacker could spoof reviews, approvals, labels, and review requests to make malicious code appear legitimately vetted to human maintainers. Google mitigated the vulnerabilities by late July 2026, and no active exploitation was confirmed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

GitOps Tutorial: How Argo CD Uses Git to Automatically Manage Kubernetes Clusters

A developer has published a hands-on guide explaining how to implement GitOps on a Kubernetes cluster using Argo CD, the open-source continuous delivery tool. The approach replaces manual kubectl commands by treating a Git repository as the single source of truth for cluster configuration. When Argo CD is configured with automated sync, self-healing, and pruning enabled, any manual change to the cluster — such as scaling a deployment or deleting a service — is automatically reversed within roughly 15 seconds to match the Git state. The setup was demonstrated on a modest 4GB Hetzner VPS already running other workloads, with Argo CD consuming around 500MB across seven pods. A key benefit highlighted is that every cluster change becomes a Git commit, effectively providing a built-in audit log, rollback mechanism, and change-review process at no extra engineering cost.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Open Source Powers Global Tech but Faces Sustainability and Ethics Challenges

Open source software has evolved from a countercultural movement into the dominant foundation of global technology infrastructure, underpinning everything from web servers to mobile operating systems. Its key strengths include transparent code auditing, freedom from vendor lock-in, and the collective intelligence of decentralized global developer communities. The model has also democratized access to enterprise-grade tools, allowing small startups to compete with large corporations using the same open infrastructure. However, the rapid growth of open source adoption has introduced serious tensions around sustainability, ethics, and the imbalance between corporations that profit from the ecosystem and the communities that build and maintain it. Analysts argue that an honest assessment of open source must acknowledge both its architectural and economic advantages and its deepening operational and ethical fault lines.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ChainDrop Worm Hijacks npm Packages to Steal Credentials and Self-Propagate

A critical supply chain attack dubbed 'ChainDrop,' part of the Shai-Hulud worm family, was disclosed by Aikido Security on August 4, 2026, affecting over 434 npm packages including keyv, flat-cache, and file-entry-cache, with combined downloads exceeding 2 billion per month. Attackers compromised GitHub accounts of package maintainers, pushed malicious files directly to repositories, and used legitimate GitHub Actions to publish tainted versions that carried valid provenance signatures. Once a user or CI system installs an affected package, a preinstall script silently downloads the Bun runtime and executes obfuscated malware that harvests credentials from npm, GitHub, AWS, Kubernetes, HashiCorp Vault, Stripe, Slack, and local environment files. Stolen tokens are then used to republish compromised versions to npm and commit malicious code to up to 50 GitHub branches, while hooks injected into VS Code and Claude Code settings ensure the attack re-executes when developers open affected repositories. Exfiltrated data is uploaded to a public GitHub repository, with a blockchain-resolved fallback domain serving as a secondary exfiltration endpoint.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Forescout Finds 15 Flaws in TP-Link Omada That Allow Full Fleet Takeover

Forescout's Vedere Labs disclosed 15 vulnerabilities in TP-Link's Omada Zero-Touch Provisioning system on August 4, 2026, tracked across multiple CVEs including CVE-2025-7850 and CVE-2025-9289 through 9293. Attackers can exploit predictable serial numbers and spoofed MAC addresses to win device adoption race conditions at roughly 1,000 devices per 17 requests per second. By chaining default credentials, hard-coded keys, and weak certificate validation, adversaries can hijack cloud controllers, steal site credentials, inject malicious scripts into the admin interface, and execute root commands on managed devices. The flaws also affect related TP-Link product lines including VIGI, Festa, Tapo, and Kasa, which share the same protocol and trust components. Forescout noted approximately 1,800 Omada controllers are currently exposed to the internet, and detection is difficult because the attack traffic closely resembles normal ZTP activity.

0 comments Read more at DEV Community