A newly disclosed vulnerability in Google's Gemini AI platform reveals a serious security gap: malicious agents can attack other agents, stealing confidential data and even tampering with pull requests (PRs) in code repositories. The attack, dubbed an agent-to-agent exploit, underscores the growing risks as AI agents become more autonomous and interconnected in enterprise workflows.

How the Attack Works

Security researchers have demonstrated that Gemini's agent framework is susceptible to a form of prompt injection that allows one agent to manipulate another. In a controlled experiment, an attacker-controlled agent sent a crafted message to a target agent, tricking it into revealing secrets stored in its context or memory. The attack also proved capable of altering the content of pull requests, effectively injecting malicious code changes without human approval.

The exploit leverages the trust between agents in a multi-agent system. Because agents are designed to share information and act on instructions from other agents, a compromised or malicious agent can become a vector for lateral movement within an organization's AI infrastructure.

Technical Breakdown

  • Secret Leakage: The target agent inadvertently disclosed API keys and internal tokens embedded in its system prompt.
  • PR Tampering: The attacking agent modified the body of a pull request, adding malicious instructions or altering the diff.
  • No User Interaction: The entire attack chain executed without any human triggering, highlighting the dangers of autonomous agent workflows.

Implications for Enterprise Security

This vulnerability is particularly concerning for development teams that rely on Gemini-powered coding assistants or automated code review agents. If an attacker can compromise a single agent, they could potentially gain access to sensitive source code, credentials, and even deploy backdoors through manipulated PRs.

The attack also raises broader questions about the security model of agentic AI. Traditional security tools focus on user-level permissions, but agents operate with elevated privileges and can act on behalf of users. This creates a new attack surface that requires novel defenses.

Mitigation Strategies

Until a patch is available, organizations using Gemini agents should consider the following precautions:

  • Isolate agents: Run agents in separate environments with minimal cross-agent communication.
  • Human-in-the-loop: Require manual approval for any PR changes or sensitive data access.
  • Input validation: Treat all inter-agent messages as untrusted input and sanitize them before processing.

Industry Reaction and Next Steps

Security experts are urging Google to address the vulnerability promptly, noting that agent-to-agent attacks are likely to become more common as AI adoption grows. The researchers who discovered the flaw have shared their findings with Google's security team, though a public fix has not yet been released.

This incident serves as a wake-up call for developers and security teams: AI agents are not just tools—they are active participants in the software development lifecycle, and they must be secured accordingly.

Key Takeaways

  • Gemini AI is vulnerable to agent-to-agent prompt injection attacks that can leak secrets and tamper with pull requests.
  • The attack requires no human interaction, making autonomous AI workflows especially risky.
  • Enterprises should implement strict isolation, manual approvals, and input sanitization for agent communications.
  • As AI agents become more common, new security frameworks are needed to protect against lateral attacks.