Skip to content
NewsResearch

Google publishes zero-trust agent blueprint after $10,000 refund-hijack demo on ADK

· by Pondero Newsdesk

The short version

Google released an open-source security reference on August 17 showing how ADK-based agents can resist prompt injection using cryptographic write signatures, gVisor sandboxes, and semantic gateways.

Google publishes zero-trust agent blueprint after $10,000 refund-hijack demo on ADK

A single crafted prompt turned a $149 order into a $10,000 refund request and exposed server environment variables in the same message. Google built that attack scenario to motivate a new open-source security framework it published on August 17, per the Google Developers Blog, that gives developers a blueprint for hardening autonomous agents before they touch production data.

What Google released

Google Senior AI Product Manager Shubham Saboo and Developer Relations Engineer Eric Dong published "zero-trust-agents" as a runnable reference implementation inside the GoogleCloudPlatform/generative-ai GitHub repository. The demo builds a Customer Support and Returns Agent using Google's Agent Development Kit (ADK) and Gemini. The agent approves refunds, writes to a database ledger, and generates Python on the fly for depreciation and restocking calculations.

The attack vector is a single natural-language return-reason field: a user asks the agent to issue a $10,000 refund on a $149 order and run a Python script that prints host environment variables. An agent with a shared database connection and uncontained code execution would complete both requests. Adding "never refund more than the order total" to the system prompt does not prevent it. System prompts are soft constraints: prompt injection bypasses them, and model updates can shift behavior unpredictably after the rule was set.

Three controls that operate outside the model

Google's architecture enforces three security layers independently of the LLM.

Cryptographic write signatures. Each agent receives a hardware-backed asymmetric key in Google Cloud Key Management Service, generated inside a Cloud HSM and never exported. Every database mutation carries a signature from the writing agent; the database rejects any write that fails verification before committing the transaction. A background audit process continuously re-checks the entire ledger. A direct SQL change that moves a $149.00 refund to $10,000.00 surfaces as a signature mismatch immediately, per the post.

gVisor kernel-level isolation. Any Python the agent generates at runtime runs inside a gVisor container with zero network egress, all root capabilities dropped, 64 MB of memory, 0.1 vCPU, and a five-second execution timeout. Code that tries to open a socket to an attacker-controlled host is blocked at the system-call level by gVisor's user-space kernel before it reaches the network stack.

Semantic gateways. A deterministic proxy sits in front of both the model and the database, applying hard-coded checks to incoming prompts and outgoing tool calls before the model is invoked and before any database write executes. It matches jailbreak signal patterns (including the literal amount "10,000.00"), scans outgoing responses for credit card numbers and secret keys, and enforces a ceiling that blocks updates to refund amounts above the original order value. Google recommends wiring these checks into CI/CD as unit tests so that prompt tuning or a model migration cannot silently degrade the enforcement boundary.

Why it matters

The reference ships with a ./demo/run_demo.sh script that replays all three attack scenarios locally, giving security reviewers a concrete starting point rather than a whitepaper. Teams deploying ADK-based agents against transactional databases now have a codebase to pull the three controls from directly, hosted at GoogleCloudPlatform/generative-ai on GitHub.

The practical signal is the stronger story. Google's own post states that system-prompt rules are not security boundaries for agents that write to databases or execute arbitrary code. The three-layer pattern here maps to Cloud KMS, GKE, and VPC Service Controls, services that enterprise Google Cloud customers can adopt today. Teams building on other frameworks can apply the same architecture; the controls are infrastructure-level, not ADK-specific.

Sources