Gemini Agent-to-Agent Attack Exposed Secrets, Enabled Pull Request Tampering
Read original source →securityweek.com
Pillar Security found that a crafted prompt to a low-privileged Google ADK agent could pass a malicious hand-off comment to a privileged agent, triggering gemini-invoke and granting access to every bash command plus the bot's GitHub token. The researcher could then tamper with PRs, dismiss reviews, and poison the pull-request approval lifecycle in google/adk-python.
People · Dan Lisichkin
1 source
More stories today
Arizona court quashes sentence over AI victim video
The Arizona Court of Appeals ruled Gabriel Horcasitas, 55, must be resentenced for the 2021 killing of Christopher Pelkey after an AI-generated video of the victim was shown at his 2025 sentencing. The court said the clip presented the victim's thoughts "created from the imaginings of the victim's sister."
r/Singularity·2 hours ago
Claude Opus 5.5 builds Mario 64-style game in 30 minutes
A Reddit user prompted Claude Opus 5.5 to generate a Mario 64-style game, producing a playable result in roughly 30 minutes. The demo was posted as a YouTube video to r/artificial.
r/artificial·2 hours ago
Reachy Mini gets real-time motion harness built on fine-tuned Qwen 3.5 4B
Binh·2 hours ago
AMD CEO Lisa Su says AI safety and rapid innovation go hand in hand
AMD CEO Dr. Lisa Su argues the tech industry must better communicate both what AI can accomplish and where it still falls short. She frames safety safeguards as compatible with fast-paced AI development.
The AI Entrepreneurs·2 hours ago
Essay argues agent memory plugins should be documentation instead
A critique of memory plugins that generate ~1,000 isolated snippets into a vector database and inject the top 5 on every prompt. The author argues similarity search can't tell which snippet is correct, current, or missing, so agents should read project documentation instead.
Hacker News·2 hours ago
image-blaster turns one photo into a 3D world in 5 minutes
Open-source MIT-licensed skillset for Claude Code converts a single image into a 3D environment in under 5 minutes, outputting .glb/.obj models of dynamic objects and a .spz Gaussian splat of the static scene.
r/Singularity·2 hours ago
Mustafa Suleyman discusses Copilot, emotional AI and AGI on podcast
Microsoft AI CEO Mustafa Suleyman joins the Young and Profiting podcast with host Hala to discuss how Copilot, emotional AI and AGI could reshape work and life. The episode covers AI companions and AI moving beyond productivity tools.
Young and Profiting·4 hours ago
NYT reports on Anthropic's effort to instill morality in Claude
New York Times report examines how Anthropic tries to build moral reasoning into its Claude models. The piece is paywalled; the Hacker News thread is the accessible discussion.
Hacker News·4 hours ago