CVE-2026-18236

This vulnerability in Google's ADK (Agent Development Kit) allows complete tool execution takeover through three validation gaps working in sequence: the system never verifies that a tool being called is actually registered to the agent being run, never validates whether confirmation was required for that tool, and never confirms that the arguments in the execution request match what the user supposedly confirmed in session history. The root cause is architectural: session history was treated as trusted input rather than potentially attacker-controlled data. If a forged confirmation entry appears in the history, the system assumes it's legitimate and proceeds with execution. For defenders, the immediate check is straightforward: audit any agentic workflows where tool calls can originate from untrusted or external input sources. If your ADK agents accept tool invocation requests without validating the requester's identity or the tool's registration status to that specific agent, you're exposed. The vulnerability manifests when external input can inject entries into what the system considers 'confirmed' session history — the confirmation prompt may never have actually appeared to a legitimate user. The deeper concern is the inheritance pattern. This exact confirmation-bypass class has appeared in LangChain, AutoGPT-class systems, and now ADK. The common thread: confirmation prompts living in the same data structure the LLM uses to decide its next action. If you're building on any agent framework, treat session history as untrusted input and implement explicit authorization checks at tool-execution time rather than relying on confirmation-state flags that originated in user-visible prompts. The fix requires rearchitecting confirmation flow to treat history as potential attack surface — not patching one gap but ensuring all three validations exist in the execution path: registration verification, confirmation-requirement check, and argument matching against confirmed history.

Reviewed through automated stages and approved by a human before publication.