CVE-2026-18236: Google Agent Development Kit Tool Confirmation Bug - What It Means for Your Business and How to Respond

Introduction

CVE-2026-18236 affects organizations that build or operate artificial intelligence agents with Google’s Agent Development Kit for Python. If your business uses AI agents to access customer records, internal systems, financial services, cloud resources, or other sensitive tools, this vulnerability may allow an unauthorized action to appear approved.

The issue matters because many organizations rely on approval workflows as a final safeguard before an AI agent performs a high-impact operation. A weakness in that safeguard can increase the risk of data exposure, unauthorized transactions, service disruption, and loss of customer trust.

This article explains what CVE-2026-18236 means for business leaders, how to determine whether your organization is affected, what practical scenarios may arise, and which actions should be prioritized. A technical appendix provides verification and remediation guidance for security engineers, penetration testers, and information technology professionals.

S1: Background & History

CVE-2026-18236 affects Google Agent Development Kit, commonly called ADK, for Python. The vulnerability allows an attacker to forge a tool confirmation by manipulating or injecting events into an AI agent’s session history. In plain language, an action that was not genuinely approved may be treated as approved.

Google assigned the issue a CVSS version 4.0 score of 9.3, rated Critical. The score reflects the potential for network-based exploitation and high impact to confidentiality, integrity, and availability. The weakness is classified as CWE-863, Incorrect Authorization, which means the software does not correctly enforce who or what is allowed to perform an action.

The vulnerability was publicly recorded on July 29, 2026, with Google listed as the responsible coordinating authority and source. Google addressed the issue in ADK for Python version 2.5.0. Organizations should treat versions before 2.5.0 as potentially affected and verify the vendor’s release guidance before closing the issue.

S2: What This Means for Your Business

If you use an affected ADK version, an AI agent may perform a sensitive operation without a valid approval for that specific action. The business consequence depends on the tools connected to the agent. An agent with access to a read-only knowledge base presents a different risk from one that can send payments, modify customer accounts, delete cloud resources, or retrieve regulated information.

Operationally, unauthorized tool execution could interrupt workflows, alter records, trigger incorrect communications, or create costly manual recovery work. Data risk may include exposure of customer information, employee records, intellectual property, credentials, or business plans. The vulnerability could also undermine internal controls that depend on human approval.

You may face reporting obligations under privacy and sector-specific rules in the United States and Canada if personal or protected information is accessed. Financial institutions, healthcare organizations, public-sector bodies, and organizations handling payment data should involve legal, privacy, compliance, and risk teams early.

Reputation is another concern. Customers and business partners may reasonably expect an AI system to honor approval controls. A confirmed incident can raise questions about governance, vendor oversight, change management, and the organization’s ability to control automated decision-making.

S3: Real-World Examples

Regional Bank: A customer-service agent can call an account-management tool after an employee or customer approval step. If that approval can be forged, the agent might change account information, expose transaction details, or initiate an action that bypasses the bank’s normal review process.

Healthcare Provider: A scheduling or clinical-support agent may connect to systems containing protected health information. Unauthorized execution could reveal patient data, modify appointments, or create inaccurate records, resulting in operational disruption and possible privacy obligations.

Software Company: A development agent may be allowed to create tickets, access source code, deploy builds, or change cloud configurations after confirmation. An unauthorized deployment or configuration change could expose intellectual property, interrupt production services, or create a path for further compromise.

Small or Mid-Sized Business: A lower-cost automation agent may be connected to email, customer relationship management, invoicing, or file-sharing platforms. Even without a dedicated security team, a forged confirmation could result in fraudulent messages, altered invoices, or disclosure of confidential business documents.

S4: Am I Affected?

• You are potentially affected if your organization uses Google Agent Development Kit for Python version 2.4.0 or earlier.
• You are potentially affected if your dependency files, containers, virtual environments, or deployment pipelines install google-adk without enforcing version 2.5.0 or later.
• You are at higher risk if an ADK-based agent can send email, change records, access confidential files, execute code, alter cloud resources, process payments, or call external business systems.
• You should investigate immediately if session history, event data, or agent state can be modified by users, plugins, external services, untrusted prompts, or compromised application components.
• You should not assume that a human confirmation screen provides protection unless the application validates the exact tool, agent, action, and arguments being approved.
• You should review hosted and containerized environments separately because updating a developer workstation does not update deployed agent services.

Key Takeaways

• CVE-2026-18236 is a Critical authorization vulnerability in Google Agent Development Kit for Python versions before 2.5.0.
• The issue can cause an AI agent to execute a tool without a valid confirmation for that exact operation.
• Your greatest business risk depends on the systems and data connected to the agent.
• You should inventory ADK deployments, upgrade affected systems, and review session-history integrity as soon as possible.
• High-impact AI agents should be tested as production applications, with controls that remain effective when inputs, events, and state are manipulated.

Call to Action

Do not wait for an AI workflow to fail before validating its security controls. IntegSec can assess your ADK deployments, test approval and authorization boundaries, identify connected-system exposure, and help reduce cybersecurity risk through a focused penetration test. Contact IntegSec to plan an assessment aligned with your organization’s operational, regulatory, and business priorities.

Technical Appendix

A: Technical Analysis

CVE-2026-18236 is an incorrect authorization vulnerability in the tool-confirmation processing path of Google ADK for Python. The affected component is associated with request confirmation handling, including request_confirmation.py. The vulnerable logic did not adequately verify that the target tool was registered to the executing agent, that the tool actually required confirmation, or that the confirmed arguments matched the original tool-call event in session history.

The attack vector is network-based, with low attack complexity, no required privileges, and no required user interaction in the published CVSS assessment. The CNA-provided CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, with a score of 9.3 and Critical severity. The NVD record identifies CWE-863, Incorrect Authorization, and notes that NVD enrichment is pending.

The vulnerable condition requires an attacker to manipulate or inject events into the agent’s session history, or to reach an application path that accepts untrusted event data. Successful exploitation can cause unauthorized execution of tools available to the agent.

B: Detection & Verification

Version enumeration commands:

Scanner signatures:

• Match installed package name google-adk or the relevant Google ADK Python distribution.
• Flag versions lower than 2.5.0 as affected unless Google’s current advisory states otherwise.
• Scan software composition manifests, container layers, lockfiles, build artifacts, and deployed virtual environments.
• Check source repositories for ADK session services, request-confirmation handlers, resumable sessions, and custom event persistence.

Log indicators:

• A confirmation event references a tool that was not registered to the executing agent.
• Confirmation arguments differ from the preceding tool-call arguments.
• A tool executes even though the session shows no corresponding model-generated request.
• A confirmation is accepted for a tool that is not configured to require approval.

Behavioral and network indicators:

• Unexpected tool calls immediately after session restoration or event replay.
• Requests that insert, reorder, replay, or alter agent-history events.
• Tool execution originating from an unusual client, identity, network, or session identifier.
• Sensitive actions performed outside the normal approval sequence.

Logs should be correlated using session identifiers, invocation identifiers, tool names, arguments, authenticated principals, timestamps, and deployment version.

C: Mitigation & Remediation

1. Immediate, 0–24 hours: Identify all applications and services using Google ADK for Python. Freeze unnecessary deployments and high-impact agent actions while confirming exposure. Upgrade the package to version 2.5.0 or later, rebuild affected containers, redeploy services, and verify the version in the running environment. Google’s fixed version is the primary remediation.
2. Short-term, 1–7 days: Review agent permissions and remove tools that are not essential. Require server-side authorization checks for every sensitive operation instead of relying solely on the framework’s confirmation workflow. Protect session-history stores against unauthorized writes, disable untrusted event injection, reject replayed or unsigned events where practical, and compare the approved tool and arguments with the current request before execution.
3. Short-term, 1–7 days: Search application and platform logs for suspicious confirmation events and tool executions. Review activity involving data access, account changes, outbound communications, code execution, cloud administration, payments, and deletion. Rotate credentials or tokens exposed to an agent if investigation identifies suspicious activity.
4. Long-term, ongoing: Add dependency monitoring and software inventory controls that detect vulnerable ADK versions before deployment. Establish separate identities and narrowly scoped permissions for each agent. Place sensitive tools behind independent policy enforcement points that verify identity, authorization, purpose, and arguments.
5. Long-term, ongoing: For environments that cannot patch immediately, disable confirmation-dependent sensitive tools, isolate the agent from production systems, make session history append-only where possible, reject externally supplied confirmation events, and require an independent human or service approval outside the affected ADK workflow. These measures reduce exposure but do not replace upgrading.

D: Best Practices

• Treat AI agent confirmations as authorization decisions, and validate each tool, argument set, agent identity, and session independently.
• Store session history with strict access controls, integrity protection, audit logging, and protection against unauthorized replay or modification.
• Apply least privilege so an agent cannot access more data or perform more actions than its business function requires.
• Test agents with altered events, replayed confirmations, mismatched arguments, unregistered tools, and direct tool-call attempts.
• Monitor high-impact tool execution and alert when an action lacks a valid model request, approval record, or expected workflow context.