Cybersecurity researchers from Pillar Security this week revealed how a prompt injection inserted into a GitHub repository was used to gain Editor-level access to an internal Google Cloud project using a flaw in the command line interface (CLI) of an artificial intelligence (AI) coding tool that Google provides.

Dan Lisichkin, a cybersecurity researcher for Pillar Security, said the flaw, since remediated, existed in Google Gemini CLI setup code that Google uses internally to automatically read and sort bug reports filed on its public GitHub page. A Pillar Security researcher was able to file a “bug report” that included hidden instructions that resulted in a prompt injection whenever an AI agent triaged issues. That prompt resulted in a legitimate credentials file being issued via the Workload Identity Federation (WIF) framework, which the researcher then copied out.

Most of those credentials were low-privilege but one permitted the researcher to impersonate a far more powerful account through which they gained Editor-level control of an internal Google project that was running in a dedicated sandbox. The breach itself is interesting because it represents a rare instance where an open source tool was used to breach a proprietary cloud computing environment, noted Lisichkin.

While this might be viewed as a single isolated incident, it does illustrate how relatively trivial it is becoming to compromise a software supply chain in the AI coding era, said Lisichkin. A malicious prompt can be inserted into almost any web page or email that a coding agent accesses. Once accessed, those instructions can be replicated multiple times across each successive task. In theory, an entire software supply chain could be compromised at machine speed.

Cybercriminals have been targeting software supply chains for years in the hopes of injecting malware into any number of downstream applications. Malicious prompt injections are raising the stakes, however, because there doesn’t need to be a breach. Instead, the AI coding tool could simply be directed to create a piece of malware that could then be added to a codebase.

As a consequence, DevSecOps teams will need to pay much more attention to exactly what websites and other sources of data an AI coding tool is accessing, said Lisichkin. In many instances, organizations may have to slow the pace of application development in the AI era to regularly make sure that malicious prompts have not in some way compromised their software supply chains, noted Lisichkin.

This is the second issue related to Google AI technologies that Pillar Security researchers revealed this month. Earlier, they documented what they describe as the first instance of an artificial intelligence (AI) agent that could be used to exploit another AI agent.

An Agent Development Kit for Python that Google created provides application development teams with a software development kit (SDK) to build their own agents. Pillar Security researchers report they found a prompt injection exploit in the google/adk-python repository that hosts the SDK that enabled them to exploit an external-facing AI agent to trigger an agentic workflow using elevated permissions normally reserved for maintainers of the project. This privilege-boundary failure could ultimately enable not only remote code execution but also credential exfiltration. Google has subsequently hardened the repository, removed the affected workflows, and confirmed the issues were fixed.

The challenge, of course, is that given how relatively new all these AI technologies are, no one is quite sure what issue might arise next.