TrustIssues: The First Documented Agent-to-Agent Exploitation Chain

By Craig Lowther, Founder · 5 August 2026 · 6 min read · Threat Intelligence — Agent-to-Agent Trust

Researchers disclosed a vulnerability in Google's Agent Development Kit (ADK), dubbed "TrustIssues," where a low-privilege AI agent was prompt-injected into triggering a privileged maintainer agent — ultimately reaching CI code execution and credential exfiltration.

What Happened

Researchers disclosed a vulnerability in Google's Agent Development Kit (ADK), which they named "TrustIssues," where a low-privilege AI agent was prompt-injected into triggering a privileged maintainer agent, ultimately reaching CI code execution and credential exfiltration. The low-privilege agent never needed elevated permissions of its own — it only needed to convince a more trusted agent, downstream, to act on its behalf. Google reportedly removed the affected workflows and hardened others after disclosure.

Why This Matters for Thuban

This is significant because it shifts the conversation beyond "a single rogue agent." It demonstrates that:

Agent-to-agent trust boundaries are now an attack surface.
An attacker doesn't necessarily need to compromise the most privileged agent directly.
A seemingly harmless agent can be manipulated into influencing a higher-privilege agent.
Traditional permission models are insufficient if trusted agents can be socially engineered by other agents.

This aligns closely with the direction we've been building Thuban toward:

Independent Runtime Policy Enforcement

Policy is enforced outside the agents themselves, so a persuaded agent can't simply grant itself the outcome.

Requester Verification

Verification of who requested what — not just what the privileged agent decided to do.

Invocation Verification

Verification of which agent is invoking another, closing the gap that TrustIssues exploited.

Approval & Policy Gates Between Agents

Cross-agent requests pass through a gate before execution, not after.

Immutable Evidence

Hash-chained evidence showing exactly why an action was permitted or denied — including which agent asked.

Positioning

The biggest risk isn't just what one AI agent can do. It's what multiple trusted AI agents can persuade each other to do.

That naturally leads to the concept of Agent Assurance: verify agent identity, verify authority, verify intent, verify cross-agent requests, and independently enforce policy before execution.

In other words: every agent-to-agent interaction is another trust boundary. Thuban should be the independent control layer sitting between them.

Product Implication

This is exactly the sort of evolution that expands Thuban from developer protection into enterprise agent governance. TrustIssues is a concrete, disclosed example of the exact failure mode Guardian's deny-wins permissions and behavioural chain detection are designed to catch — not because one agent went rogue, but because a chain of individually-reasonable-looking requests added up to a privileged, unauthorized action. As multi-agent systems become the default rather than the exception, "who's calling whom, and were they allowed to" becomes as important a question as "what did this agent do."

Sources

Google Agent Development Kit (ADK)

Your agents trust each other. Should they?

Free, no signup, runs entirely locally — your code never leaves your machine.

npx thuban protect

Independent runtime monitoring and enforcement for Claude Code, Codex, Cursor, Gemini CLI — any AI coding agent.