Critical CVSS 10.0 Vulnerability in Google's Agent Development Kit

On September 9, 2026, CVE-2026-79696 was disclosed: a critical vulnerability with a CVSS score of 10.0 in Google's Agent Development Kit (ADK) for Python — the open-source framework with over 90 million downloads that many companies now rely on to build and deploy AI agents.

What the vulnerability actually allows

The flaw affects adk-python versions 2.0.0 through 2.6.0, in environments where pytest is installed (OSS, Cloud Run, and GKE). It stems from improper handling of disallowed input (CWE-184) in the "adk web" component: an unauthenticated remote attacker can achieve arbitrary code execution through a manipulated test session replay. In practical terms, this is about as severe as a software vulnerability gets — which is why it carries the maximum CVSS score of 10.0.

Not an isolated incident for ADK

This disclosure lands just months after Pillar Security researchers documented, in June 2026, what they described as the first real-world case of one AI agent being used to exploit another — with the vulnerability residing in that same ADK for Python open-source repository. Google fixed that earlier issue in the repository, though it classified it as ineligible for a bounty since it involved social engineering. The pattern emerging here is that an agent framework as widely adopted as ADK is becoming a recurring target for both security research and real-world exploitation.