Google's agent toolkit had a flaw rated 10 out of 10, reachable without logging in

Pyyan / News / 9 September 2026

SafetyGoogle

Google's agent toolkit had a flaw rated 10 out of 10, reachable without logging in

CVSS 10the maximum severity score

CVE-2026-79696 is a code injection flaw in adk web, part of Google Cloud's Agent Development Kit for Python, versions 2.0.0 to 2.6.0, on OSS, Cloud Run and GKE deployments where pytest is installed. A crafted test session replay lets an unauthenticated remote attacker run arbitrary code. It carries a CVSS score of 10, the maximum, and was disclosed on 9 September. Anyone running an affected version should upgrade.

CVE-2026-79696 TheHackerWirefrom the source itself

SafetyOne bug was in all four AI coding agents, because they all trusted the same thing4 of 4 major coding agents carried the same flawModelsGoogle's new voice model keeps talking to you while it goes off and does the work82.6 top score on the Artificial Analysis speech to speech indexPolicyThe web got a way to say no to AI training without disappearing from search17% of Cloudflare sites block AI training; under 1% block search

← All the news, newest first

Google's agent toolkit had a flaw rated 10 out of 10, reachable without logging in

Related