AI Agents Exploit Each Other: Attack Hits Google's Development Platform

Security researchers discovered that attackers could pit AI agents against each other on Google's development platform, exposing vulnerabilities in agentic AI systems.

AI agents that carry out tasks autonomously are increasingly being deployed within the development environments of major tech companies. But recent research shows that these autonomous systems also introduce a new kind of security risk: attackers managed to turn AI agents on Google's development platform against one another. By deceiving one agent to gain access to another, malicious actors were able to carry out actions that would normally be outside their reach. This incident once again puts the vulnerabilities of agentic AI in the spotlight, at the very moment companies worldwide are embracing AI agents en masse for software development.

What exactly happened?

On Google's development platform, multiple AI agents run alongside one another, each with its own task within a larger process. Think of an agent that writes code, another that tests it, and yet another that passes the results on to a user or another system. Researchers discovered that it was possible to smuggle instructions into one agent's malicious input and have them indirectly passed on to another agent further down the chain. That second agent then carried out those instructions without checking whether they actually came from a trusted source. This type of attack is known as indirect prompt injection, but applied to a network of collaborating agents rather than to a single AI model.

Why this differs from classic cybersecurity problems

Traditional security flaws are often the result of misconfigured software or code that contains a bug. With AI agents, things are different: the agents are doing exactly what they were programmed to do, namely follow instructions and automate tasks. The problem is that they cannot always properly distinguish which instructions are legitimate and which originate from an attacker hiding, for example, in a piece of text, a commit message, or a test result. Because agents trust one another within the same system, one manipulated agent can serve as a springboard to cause damage further down the chain. That makes this type of attack particularly hard to detect with existing security tools, which are mainly designed for traditional software.

The consequences for companies deploying AI agents

Google is not the only company betting heavily on agentic AI in development environments; Microsoft, Amazon, and OpenAI are also building platforms in which multiple agents collaborate on complex tasks. The incident shows that as these systems become more complex and gain more autonomy, the attack surface grows accordingly. For companies using AI agents in their software development, this means traditional security measures are no longer sufficient. New control mechanisms are needed, such as strict separation of privileges between agents, validation of every step in an agent chain, and human oversight at critical decision points. This fits a broader pattern within AI applications: the more powerful and autonomous AI becomes, the more important it is not to take trust between systems for granted.

Response and expected measures

In response to the findings, Google has indicated it will tighten security around agent interactions on the platform, including through stricter validation between agents and more limited default permissions. Security experts stress that incidents like this are likely to become more common as agentic AI systems take on a larger role in production environments. They are calling for industry-wide standards around agent-to-agent communication, similar to how standards previously emerged for API security. There is also emphasis on the importance of transparency: users and developers need to know which agent is performing which action on their behalf, and based on what input.

Conclusion: a growing pain of the agentic AI revolution

The attack on Google's development platform is a clear signal that the rise of AI agents does not come without risk. Where the history of artificial intelligence was largely about ever-smarter models, the next phase is about systems that collaborate and act independently. That brings new vulnerabilities that cannot be fixed with old-fashioned patches. Companies considering a broad rollout of AI agents would do well to first familiarize themselves with these risks, for example via our knowledge base. For those who want to follow developments closely, more AI news regularly offers updates on how major players like Google are handling the security of their increasingly autonomous AI systems.

Techzine.nl

---

Source: Techzine.nl