Google ADK AI Workflows Vulnerability: Prompt Injection Detection and Remediation Guide

---
title: Potential ADK Prompt Injection via GitHub Comment
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects GitHub API activity containing suspicious ADK-related command strings that may indicate prompt injection attempts targeting AI agent workflows.
references:
  - https://github.com/google/agent-development-kit
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: web
  product: github
detection:
  selection:
    cs-method|contains: 'POST'
    cs-uri-stem|contains: '/issues/comments'
    sc-content|contains:
      - '/adk-issue-fix'
      - 'adk-bot'
  condition: selection
falsepositives:
  - Legitimate ADK bot activity
  - Authorized testing workflows
level: high
---
title: Suspicious ADK Python Workflow Execution
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects execution of ADK Python workflows with GitHub-related parameters that may indicate exploitation of vulnerable agent workflows.
references:
  - https://github.com/google/agent-development-kit
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/python3'
    CommandLine|contains:
      - 'adk'
      - 'github'
    CommandLine|contains:
      - 'issue'
      - 'comment'
      - 'fix'
  condition: selection
falsepositives:
  - Legitimate ADK development workflows
  - Authorized agent operations
level: medium
---
title: GitHub Token Usage by ADK Workflows
id: 9b4e2d93-0f5c-4e78-bc23-4f6b9g012345
status: experimental
description: Detects authentication events using GitHub tokens in conjunction with ADK workflow execution, potentially indicating exploited agent privilege escalation.
references:
  - https://github.com/google/agent-development-kit
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/python3'
    CommandLine|contains:
      - 'GITHUB_TOKEN'
      - 'GH_TOKEN'
    CommandLine|contains:
      - 'adk'
  condition: selection
falsepositives:
  - Legitimate CI/CD workflows
  - Authorized ADK operations
level: medium

// Hunt for GitHub API calls potentially related to ADK prompt injection
let suspiciousCommands = dynamic(["/adk-issue-fix", "adk-bot"]);
GitHubAuditLogs
| where OperationName in ("issue_comment", "create")
| where Action =~ "created"
| project TimeGenerated, Actor, Repository, Action, Details
| where tostring(Details) has_any (suspiciousCommands)
| extend AccountType = case(Actor contains "[bot]", "Bot", "User")
| order by TimeGenerated desc


// Monitor for suspicious Python processes executing ADK-related workflows
DeviceProcessEvents  
| where Timestamp > ago(1d)
| where FileName =~ "python3" or FileName =~ "python"
| where ProcessCommandLine has "adk" 
  and (ProcessCommandLine has "github" or ProcessCommandLine has "issue")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

-- Hunt for ADK-related Python processes and script executions
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "python3" 
   AND CommandLine =~ "adk"
   AND (CommandLine =~ "github" OR CommandLine =~ "issue")


-- Scan for ADK workflow files that may contain vulnerable configurations
SELECT FullPath, Size, Mtime, Data
FROM glob(globs="/*agent*development*kit*/**/*.py")
WHERE Data =~ "issue-fix" OR Data =~ "triage.*agent"

#!/bin/bash
# Google ADK Vulnerability Remediation Script
# This script checks for vulnerable ADK workflows and applies remediation

set -e

echo "[+] Checking for Google ADK installations..."

# Find ADK installations
ADK_PATHS=$(find /home /opt /usr/local -type d -name "*agent*development*kit*" 2>/dev/null || true)

if [ -z "$ADK_PATHS" ]; then
    echo "[-] No Google ADK installations found."
    exit 0
fi

echo "[+] Found ADK installations:"
echo "$ADK_PATHS"

# Check for vulnerable workflow files
echo "[+] Checking for vulnerable workflow files..."
VULN_FILES=$(find $ADK_PATHS -type f -name "*.py" -exec grep -l "issue-fix" {} \; 2>/dev/null || true)

if [ -n "$VULN_FILES" ]; then
    echo "[!] Found potentially vulnerable workflow files:"
    echo "$VULN_FILES"
    
    # Backup vulnerable files
    echo "[+] Creating backups of vulnerable files..."
    BACKUP_DIR="/var/backups/adk_remediation_$(date +%Y%m%d_%H%M%S)"
    mkdir -p "$BACKUP_DIR"
    cp $VULN_FILES "$BACKUP_DIR/" 2>/dev/null || true
    
    # Remove vulnerable workflows
    echo "[!] Removing vulnerable workflow files..."
    for file in $VULN_FILES; do
        echo "Removing: $file"
        rm -f "$file"
    done
    
    echo "[+] Backups saved to: $BACKUP_DIR"
else
    echo "[+] No vulnerable workflow files found."
fi

# Check for ADK bot tokens in environment
echo "[+] Checking for exposed ADK bot tokens..."
if env | grep -i "GITHUB.*TOKEN" | grep -i "adk" > /dev/null; then
    echo "[!] WARNING: Exposed ADK-related GitHub tokens found in environment."
    echo "    Please rotate these tokens immediately."
else
    echo "[+] No exposed ADK-related GitHub tokens found."
fi

# Update ADK to latest version if package manager is available
echo "[+] Checking for ADK package updates..."
if command -v pip3 &> /dev/null; then
    pip3 list | grep -i "adk" && echo "[+] Attempting to update ADK packages..." && pip3 install --upgrade google-adk 2>/dev/null || echo "[-] No ADK packages found via pip3"
fi

echo "[+] Remediation complete. Please review logs and confirm changes."
echo "[!] IMPORTANT: If you have ADK workflows integrated with GitHub, review and update your agent permissions immediately."