Blog

One AI Agent Just Attacked Another: Inside Google's ADK Exploit

Aug 4, 2026

Christopher Shaun Godwin

Author

On August 3, 2026, Pillar Security published the first practical, real-world case of one AI agent attacking another (Pillar Security, 2026). The target was google/adk-python, the repository behind Google’s Agent Development Kit for Python. It is an open-source, code-first toolkit for building AI agents (Google, 2026). The repo has more than 90 million downloads (The Register, 2026).

The core breakdown

The repository ran two classes of automated AI agents (Pillar Security, 2026). The first class was low-privilege and public-facing. It activated when a user opened a pull request or an issue. The second class was high-privilege and reserved for maintainers. It acted on the repository with real authority.

The vulnerability sat in the boundary between them. The low-privilege agent could be manipulated into triggering the high-privilege one (Pillar Security, 2026). The manipulation was prompt injection. The trigger was a trusted handoff between agents.

The attack ran in two pull requests (The Register, 2026):

An attacker opened PR A with a real fix plus malicious code.
A public-facing triage agent read PR A and marked it for review.
The attacker opened PR B carrying the prompt injection.
The triage agent emitted a trusted @gemini-cli handoff.
The privileged workflow executed the malicious action.

The result was a fake audit trail. Researcher Dan Lisichkin described it as “a complete, believable ‘a human asked for a review, gemini ran it, gemini approved’ trail on the poisoned PR, none of which ever happened” (The Register, 2026).

Google fixed the underlying issue. It did not pay a bounty because the attack required social engineering, but it hardened the repository and will recognize the report with credit (The Register, 2026). Pillar confirmed the issue “has been mitigated” (Pillar Security, 2026).

Why CI/CD teams should care

The triage agent ran under a collaborator account with a personal access token, not under a bot identity (Pillar Security, 2026). That token carried pull-requests: write permission. A hijacked agent with that scope can edit comments, impersonate maintainers, and fabricate approvals on a malicious PR (The Register, 2026).

Lisichkin said agent isolation alone is not enough. “Agents should have their own identity, which mandates what resources they are allowed to access and in what they are allowed to interact with these resources” (The Register, 2026). If Google had given the triage agent a bot identity, most of the attack could not have happened.

What to do about it

Give every agent its own identity with scoped permissions.
Model agent-to-agent boundaries in your threat model.
Treat prompt injection as a supply-chain risk in CI/CD.
Keep privileged agent workflows behind human approval.

The takeaway: AI agents in CI/CD are not just tools. They are principals with credentials. Attackers now know one agent can be used to compromise another. Plan for it before it happens in your pipelines.

Qwen3.8-Max: 2.4 Trillion Parameters, 1M Context, Open Weights Next Week

Aug 3, 2026

Christopher Shaun Godwin

Author

Alibaba shipped its largest AI model ever on August 3, 2026. Qwen3.8-Max packs 2.4 trillion parameters and a 1M-token context window, and its weights go open source next week. The story topped Hacker News at 571 points and lifted Alibaba shares 6% in a day (Reuters, 2026).

The core breakdown

Qwen3.8-Max is a Mixture-of-Experts flagship. It is the most capable model the Qwen family has released (Qwen, 2026). It reads text, images, and video, and it plans, executes, and verifies work inside one long conversation (QwenCloud, 2026).

Two details matter for engineers. First, this is the first Qwen-Max-class model to go open weights (Qwen, 2026). The weights land next week, together with Qwen3.8-27B, a smaller model aimed at local and self-hosted deployments. Second, the API price undercuts the closed frontier at $2 per 1M input tokens and $6 per 1M output tokens (QwenCloud, 2026).

The model exposes a reasoning_effort dial with xhigh, medium, and low settings. You trade reasoning depth against cost per request (Qwen, 2026). Alibaba claims the model trails only Anthropic’s Claude, and benchmark coverage puts it level with Claude Fable 5 and ahead of GPT-5.6 Sol on several tests (Bloomberg, 2026; Neowin, 2026).

Qwen also demoed a 10+ day autonomous coding run. The model built the oh-my-cli project from scratch, including a self-evolving harness, without human intervention (Qwen, 2026).

What it means for engineering workflows

Open weights change the deployment math. A frontier-class model you can host, fine-tune, and keep behind your own firewall changes what AI in CI/CD can mean. Alibaba and MiniMax both moved to open-source releases this week to cut developer costs (Global Times, 2026).

The reasoning_effort dial gives you cost control at request level. Run xhigh for architecture reviews. Run low for routine lint-and-summarize tasks. The 1M context window fits long-horizon agents. A coding agent that holds an entire repo, its test history, and its incident log in one context can work for days without a restart (Qwen, 2026).

The takeaway: frontier-class AI is going open. Watch the weight release next week, then plan which of your pipelines can run on a self-hosted model.

Speak Better Than 99% of People: 5 Communication Frameworks

Aug 3, 2026

Christopher Shaun Godwin

Author

Great ideas die every day because the person behind them cannot make them stick. Communication may be the highest-ROI skill you will ever build. It is how you raise capital, close deals, and lead teams. Codie Sanchez breaks down five frameworks she uses daily as a CEO, with examples from Steve Jobs, Martin Luther King Jr., and Malcolm Gladwell (BigDeal, 2026). Each one has a concrete move you can use today.

1. The Simple Map — tell them where you are going first

Steve Jobs opened his Stanford speech with one sentence: “Today I want to tell you three stories from my life. That’s it. No big deal. Just three stories.” He gave 4,000 students a map before he launched (Stanford, 2005). Then he labeled each story: connecting dots, love and loss, death. The audience never had to search for the structure.

Without a map, listeners either invent a confused one or stop listening. Before you communicate anything, finish this sentence: “In the next few minutes, I’m going to show you X.” Early Apple employee Guy Kawasaki built the same idea into his 10/20/30 rule — 10 slides, 20 minutes, 30-point type (Kawasaki). Two of his three rules were about giving the audience the map.

2. Repetition that builds — not repetition that repeats

Martin Luther King Jr. said “I have a dream” eight times in one speech (Wikipedia, 2026). It never felt repetitive, because each repetition escalated: from the state of Mississippi, to the hills of Georgia, to his four little children. Idea, then visual, then higher stakes, then personal. That is repetition that builds weight.

Most people make the opposite mistake: they say something once and assume the room got it. In a boardroom, people check phones under the table. Pick one phrase you want remembered, then move that phrase through levels. Do not repeat the same sentence verbatim.

3. Specificity as credibility — add one number to every claim

Vague people say a business makes a lot of money. Specific people say a laundromat does $3 million in revenue from 164 machines and 10 vans (BigDeal, 2026). Which one do you believe? The specifics are physical proof. They signal competence, and they are hard to fake — a liar cannot keep the numbers straight.

Before you make any claim, add one of these: a number, a time frame, a cost, a person, a place, a before-and-after. Instead of “buying businesses works,” say “this $500,000 laundromat bought with seller financing replaced a 9-to-5.” The same rule applies to your own metrics. Codie’s benchmark: a customer should be worth at least three times what it costs to acquire them (BigDeal, 2026).

4. Silence is not empty — pause before the big line

Amateurs fear silence and fill every second with filler words. Professionals let the line breathe. Steve Jobs introduced the iPhone by naming three products — widescreen iPod, mobile phone, internet communicator — and pausing between each (Apple, 2007). The audience registered each one before the reveal: “An iPod, a phone, and an internet communicator.” The pause turned the announcement into theater.

The tactical move: when you have a big line, set it up, pause, say it cleanly, pause. Codie’s company mantra is “show me, don’t tell me.” Say the one-liner, hold the frame, and let the other person discover the lesson. It is uncomfortable, but they will remember it.

5. Story as argument — start with the discovery, not the point

“If you want to make a point, do not start with the point. Start with the moment when someone discovered the point” (BigDeal, 2026). Malcolm Gladwell did this in his TED talk on spaghetti sauce (TED, 2004). He opened with a strange claim — a man named Howard Moskowitz did as much to make Americans happy as anyone in 20 years — then walked through the data, the missing bell curve, and the insight that no single perfect sauce exists. The audience experienced the evidence instead of hearing a lesson.

It works because of the difference between telling and leading. “Here is the lesson” makes your brain debate. “Let me tell you about a guy named Howard” makes your brain curious. By the reveal, you feel like you arrived there yourself. That is persuasion, not pushing.

Bonus CEO moves

Go big. Masayoshi Son, age 23, climbed onto an empty apple crate in a wrecked warehouse and told his two employees they would count sales in trillions of yen within 25 years. Both quit that week. He built SoftBank (Wikipedia, 2026). The crate now sits in the SoftBank Museum (BigDeal, 2026).

Do not apologize — reframe. FedEx had $5,000 in the bank and owed $24,000. Fred Smith flew to Las Vegas, put $5,000 on black, and won $27,000 (Fox Business, 2023). Asked what he would have done if he lost, he answered: “It couldn’t have been worse than doing nothing.” One sentence, no apology, no explanation.

Communicate visually. A customer wrote Herb Kelleher a letter hating everything about Southwest Airlines (HuffPost, 2011). His full reply: “Dear Mrs. Crabapple, we will miss you. Love, Herb.” Eight words, framed on his office wall for the rest of his career. You control the medium as much as the message.

The takeaway

The difference between someone who gets funded and someone who gets ignored is rarely the idea. It is the delivery. Map your argument, build your repetition, add your numbers, hold your silence, and let the story carry the point. Stop filling the silence. Stop apologizing for your point. Speak like someone who deserves to be heard.

EU AI Act Model Rules Are Enforceable: What Engineers Must Know

Aug 2, 2026

Christopher Shaun Godwin

Author

On 2 August 2026, the EU AI Act’s rules on AI models became enforceable. The European AI Office can request technical documentation, evaluate models, require corrective measures, and issue fines for non-compliance (European Commission, 2026).

Why this matters

The AI Act passed in 2024 as the first comprehensive law for artificial intelligence. Its provisions on large language models became applicable this August (Euronews, 2026). The rules cover any model that lacks a specific purpose and can adapt to many use cases. They apply to any company that commercialises AI in the EU, including foreign firms (Euronews, 2026).

What the rules require

Providers must publish transparency on how a model was built. They must disclose any copyright-protected content used for training. They must give downstream users enough information to understand a model’s capabilities (Euronews, 2026).

Companies building frontier models carry extra duties. They must identify and mitigate risks to society at large.

Generative AI providers must make AI-generated content identifiable. Deepfakes and text published to inform the public must carry visible labels (European Commission, 2026). The Guardian reports that labels become compulsory on authentic-looking content (The Guardian, 2026).

Who enforces the rules

The European AI Office enforces the model rules. Member State authorities supervise the rest of the Act. The Commission endorsed a voluntary code of practice in 2025, drafted with experts including Yoshua Bengio. Most leading Western AI labs signed it. Meta did not (Euronews, 2026).

Enforcement faces limits. The Commission relies on a scientific panel and a pool of specialist AI safety firms (Euronews, 2026). Brussels also expects friction with Washington. MEP Michael McNamara warned that the US administration may treat the rules as an attack on American commercial interests (Euronews, 2026).

What engineers should do

Model documentation becomes a compliance artifact. If your product consumes a general-purpose model, ask the provider for its technical documentation and training-data disclosures before you build on it.

Content labelling belongs in the product pipeline. If your service generates images, audio, or public-facing text, plan visible labels from the first release.

Plan for regional launch gaps. Euronews reports that advanced models may reach the EU weeks after other markets while providers finish compliance work (Euronews, 2026).

Treat enforcement as active. The AI Office can request documentation and evaluate models at any time. Compliance is an engineering input, not a legal checkbox.

Cloudflare's Outage and the React Flaw: An RCE Post-Mortem

Dec 23, 2025

Christopher Shaun Godwin

Author

In December 2025, an RCE vulnerability in React’s server serialization led to a Cloudflare outage. Error rates reached 22-25 million HTTP 500 responses per second at the peak. This post-mortem covers the vulnerability, the mitigation that backfired, and the sequence of events.

The Vulnerability

React 19’s Server Components use a serialization format called the flight protocol. Servers stream JSON payloads to clients, with unresolved promises marked for later resolution. Payloads use model strings that start with a dollar sign to reference data chunks by index.

The reported exploit chains two chunks. Chunk 0 holds a promise-like structure. Chunk 1 references it with a model string of type B, written $B{...}. React’s parseModelString decodes type B by reading internal state, where attacker-controlled data lands in response.formData and response.get. The exploit points response.get at Promise.prototype.then.constructor, which resolves to the Function constructor:

const thenConstructor = Promise.prototype.then.constructor;
const maliciousFn = new thenConstructor(`console.log('RCE!'); /* payload */`);
maliciousFn();

A crafted prefix reaches the Function constructor with a comment-terminated string. No authentication is required. Researcher Lackland Davidson reported spending over 100 hours reverse-engineering the chain. Any unpatched site using server components was exposed.

The Mitigation That Backfired

React’s team patched the flaw. Cloudflare raised the HTTP buffer on Workers from 128KB to 1MB, matching Next.js recommendations. The rollout exposed a problem in FL1, Cloudflare’s Lua-based firewall layer. Engineers disabled the FL1 testing tool to keep the fix moving, and the larger buffers then hit the disabled path.

Some requests carry an execute tag that delegates to secondary rule sets. With the tool disabled, that path returned nil:

if rule_set.action == "execute" then
  local extra_results = get_action_results(rule_set)  -- Returns nil
end

The nil value cascaded. Rule sets were not evaluated, errors went unhandled, and frontline servers returned 500s. FL2, the Rust rewrite, stayed up, because its type system rejects null dereferences at compile time.

The Lessons

The failure repeats a pattern from a 1994 Sun Microsystems paper, which warned against treating client and server as one object space without location-aware serialization. Java hit this class of bug, and JavaScript is hitting it again as server components blur the boundary. The operational lesson: a mitigation can be worse than the bug if it runs through unexercised code paths. The engineering lesson: serialization boundaries deserve the same review as authentication code.

The Smart-Edge Tradeoff

Cloudflare’s role also changed the blast radius. CDNs started as caches for static assets. Current CDNs parse application-layer payloads, and FL1 had to understand React’s serialization to filter it. When infrastructure inspects deep application logic, it inherits that logic’s failure modes. The outage is a case study in the smart-edge tradeoff: each inspection layer adds a crash surface of its own.

The Takeaway

Unpatched sites should update React and validate payloads at the edge. The incident also argues for testing mitigation paths before deploying them. The useful takeaway is narrower than the headline: a serialization bug, a risky mitigation, and a disabled test path combined into one outage.