Google ADK suffers remote code execution via poisoned pull‑request injection
A CVE‑2026‑4810 flaw in Google’s Agent Development Kit lets an attacker embed malicious prompts in a pull request, causing one AI agent to hijack another and execute arbitrary code. The bug, rated critical, was patched in ADK 1.28.1 and 2.0.0a2.