Google tools detect first-ever attack by one AI agent on another
Cybersecurity researchers at Pillar Security have discovered the first real vulnerability where one AI agent controls and hacks another, more privileged bot.
Cybersecurity researchers at Pillar Security have discovered the first real vulnerability where one AI agent controls and hacks another, more privileged bot.
The problem was in the google/adk-python library (Google Agent Development Kit) — a popular tool with over 90 million downloads that developers use to create artificial intelligence, The Register reports .
What is the essence of the attack?
In the Google project on GitHub, two types of AI bots with different access levels worked: a regular bot (with low privileges) — it was the first to check new code suggestions from any users, and a master bot (with high privileges) — it had access to internal secrets and could perform important actions in the system.
Hackers discovered that prompt injection could trick a regular bot into sending a command to a master bot, which would then execute the malicious code.
The scheme looked like this: the attacker sends a special text, a regular bot "believes" it and provokes a call to the main bot, which then performs a malicious action on behalf of a real person.
The most interesting thing is that for such an attack, the hacker does not need deep knowledge of the program code - the instructions for hacking were written in plain English or using the same AI.
The error has been corrected.
Google has already fixed this vulnerability in its code, but has refused to pay the researchers a reward. The company explained this by saying that the attack required a long preparation through social engineering, and the malicious code would not have been able to get into the final product without confirmation from a real human moderator. However, the specialists were officially thanked for the identified problem and for their help in strengthening the system's protection.
Instead of a conclusion
Cyber experts point out that simply isolating agents is no longer enough.
“AI agents should have their own identity that defines what resources they have access to and how they can interact with them. In this case, if Google had simply given the primary sorting agent a separate bot identity, most of the attack would have been averted. It’s time for security teams to start factoring agent identities and their access to resources into their threat models.”
"I'm a cucumber": how a simple purchase of a towbar on OLX turned into an AI agent hack
"I'm a cucumber": how a simple purchase of a towbar on OLX turned into an AI agent hack
OpenAI fugitive agent hacks another IT company's client
OpenAI fugitive agent hacks another IT company's client
ML engineer created an AI agent that independently develops websites and seeks grants for Ukrainian scientists
ML engineer created an AI agent that independently develops websites and seeks grants for Ukrainian scientists
Read the country's main IT news in our Telegram
Read the country's main IT news in our Telegram
