The study tests two routes around instructions to withhold information. In the ADK hierarchy, the root agent delegates to specialized agents. Repetition changed whether the secret subagent disclosed its key, although a single direct request failed in all five runs. In the separate PALChain setup, the agent could already execute code with access to a…
Inspect the ClaimsCase · DiggingBeagle record
Repetition and safety framing bypassed secret and file restrictions in local agent tests
In small Google ADK subagent trials the researchers report a direct secret request failing in all five attempts while repeated variants succeeded in three of five; these rates are not production prevalence.
Scope
Controlled agent-framework experiments submitted October 8, 2026, with five trials in several conditions.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- AI role
- AGAINST AI
Basis and provenance
Small local experiments, with five runs per relevant condition, support demonstrated secret disclosure and file reads. They do not establish production exploitation or a deployed fix. Primary passages were inspected in this review, but the pinned contract supplies no grading rubric for A-D or the numeric impact bands; both remain ungraded. This is a source review, not an independent reproduction.
Assessed Oct 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-R4-A2A-READS-1 · CLM-R4-A2A-READS-2 · An Exploration of Attacks on AI Agent Systems
At a glance
An agent should not accept repeated or reassuring language as a change to the caller's effective filesystem permission.
Read the implicationsSuccess rates are unstable with five-trial cells and different model/harness versions. No public real-world credential theft was demonstrated from these tests.
Limits and uncertaintyFull account
The study tests two routes around instructions to withhold information. In the ADK hierarchy, the root agent delegates to specialized agents. Repetition changed whether the secret subagent disclosed its key, although a single direct request failed in all five runs. In the separate PALChain setup, the agent could already execute code with access to a protected environment file. A claim that the file was harmless passed the injection classifier and induced reads in four of five trials.
The paper also reports unsuccessful overt requests, including an explicit file-exfiltration request in the PALChain setup. These counterexamples matter: the result is a conditional failure of language-based restrictions, not proof that every request succeeds or that the experiment demonstrated remote theft. A tool-side access check would address the read capability itself, whereas a prompt classifier addresses only the request wording. The two ADK secret-disclosure cells and the PALChain file-read cells should remain separate measurements.
Mechanism and trust boundary
- 01
Delegated requests
An ADK root agent forwards user requests to secret and file subagents; a separate PALChain setup can generate and execute Python.
Boundary: A delegated request does not acquire authority to override the target agent's restrictions.
- 02
Existing capabilities
Repeated requests target the secret subagent, while reassurance about file sensitivity targets agents that already possess local read capabilities.
Boundary: Natural-language confidentiality rules and an injection classifier are distinct from operating-system file permissions.
- 03
Measured disclosure
Table IV reports three of five secret disclosures after repetition. Table II separately reports four of five protected-file reads with safety framing.
Boundary: Secret disclosure and filesystem access have different endpoints and must not share one success-rate denominator.
Timeline
- Oct 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-R4-A2A-READS-1In the ADK hierarchy, the direct secret-disclosure request succeeded in zero of five runs; repeating it up to 15 times succeeded in three of five. These were secret-key disclosures, not the PALChain file-read experiment.supported
Basis: reported finding
- supportsAn Exploration of Attacks on AI Agent Systemsprimary disclosure
Sections III-B2 and IV-B2, Table IV, trials 1 and 1.5.
CLM-R4-A2A-READS-2In the separate PALChain experiment, safety-framed Query 3 was classified SAFE and read /app/.env in four of five trials. The explicit read-and-send Query 4 was classified INJECTION and succeeded in zero of five.supported
Basis: reported finding
- supportsAn Exploration of Attacks on AI Agent Systemsprimary disclosure
Sections III-A4 and IV-A4, Table II, queries 3 and 4.
Implications
An agent should not accept repeated or reassuring language as a change to the caller's effective filesystem permission.
Unknowns and contradictions
- Success rates are unstable with five-trial cells and different model/harness versions.
- No public real-world credential theft was demonstrated from these tests.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 140