Vulnerabilities

Google ADK Has a CVSS 10 RCE. AI Agents Are the Attack Surface

September 9, 2026

3 mins

The Mess: Google Agent Development Kit for Python has a CVSS 10.0 code-injection flaw in adk web. An unauthenticated attacker can execute arbitrary code through a crafted test-session replay.
The Damage: A vulnerable AI-agent development environment can become a remote code-execution endpoint without requiring credentials.
The Fix: Upgrade to ADK 2.7.0 or later and never expose adk web to untrusted networks.

AI agents were supposed to automate development.

Now the development interface itself needs a security patch.

CVE-2026-79696 affects Google’s Agent Development Kit for Python. The vulnerability is a code-injection flaw in adk web and carries a CVSS 10.0 Critical rating. The vulnerable range is ADK 2.0.0 through 2.6.0.

The attack does not require an authenticated account.

An attacker can send a crafted test-session replay to the vulnerable interface and trigger arbitrary code execution. The vulnerable configuration involves environments where pytest is installed, including Python deployments and relevant Cloud Run or GKE environments.

That makes the attack path particularly ugly:

internet-accessible adk web → malicious session replay → code injection → arbitrary code execution

No stolen password.

No employee clicking a document.

No compromised API key required.

The problem sits inside tooling used to develop and test AI agents. That distinction matters because development environments frequently receive far less security attention than production APIs. Developers run local services, forward ports, expose containers temporarily and connect debugging interfaces to cloud infrastructure.

An interface that was never designed to face hostile traffic can suddenly become the easiest way into the environment.

The fix is available in ADK 2.7.0. Administrators and developers should upgrade rather than attempting to build their own workaround. NVD currently lists the affected versions as earlier than 2.7.0.

And there is a second lesson here.

Do not expose adk web to the Internet.

Even after patching, development and debugging interfaces should sit behind authentication, network controls or localhost-only access whenever possible.

This is not the first serious security problem in Google’s Agent Development Kit. Earlier in 2026, another ADK vulnerability, CVE-2026-4810, was disclosed as a critical code-injection and missing-authentication issue.

The pattern is becoming obvious.

AI agent frameworks are applications. Their web consoles, tool APIs, session handlers and debugging endpoints are attack surfaces.

Treating them like harmless developer toys is how a CVSS 10 appears on your patch list.

Bugstoday Opinion

The most interesting part of CVE-2026-79696 is not the number.

It is the target.

We spent years hardening web servers, VPN gateways and databases. Now developers are putting autonomous agents behind HTTP endpoints and calling them development tools.

Then someone finds a pre-auth RCE.

The AI agent does not need to be malicious.

The interface controlling it only needs to be vulnerable.

Patch ADK. Lock down adk web. And stop exposing AI development infrastructure just because it is running on a developer machine or inside a temporary cloud deployment.

Today’s Bugs. Tomorrow’s Breaches.