Agent Development Kit

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT1; supply-chain compromise is a separate category) │ $101 - $3,133.70 │ $126 - $3,916.70 Other security issue (Tier OT1 flat award) │ $500 │ $625 Submit a vulnerability CVE history 2 Last 12 months 2 Lifetime Code execution 40 % Access control 25 % Injection 20 % Info disclosure 10 % Latest advisories Loading the feed Overview The Agent Development Kit is Google's framework for building and running LLM agents, shipped in four language bindings: adk-python, adk-go, adk-java and adk-js, and it is the fastest-growing project in Google's open-source tier file; adk-python is at 20,924 stars and adk-go at 8,549 from a standing start, with all four repositories pushed the day this entry was verified. It is also the framework Google pushes for production agent deployments on Vertex AI, so the code is moving into enterprise environments faster than it is being reviewed. The security-relevant property is structural rather than historical. An agent framework's whole job is to let a language model decide which tool executes with which arguments, which means the boundary between model output and code execution lives inside this repository: in tool registration and dispatch, in the MCP client and server integration, in the built-in code-execution and shell tools and their sandboxing, and in the delegation boundaries between agents. That is new and largely unexamined attack surface carrying one CVE across four bindings. Google pays for it on the Bug Hunters open-source VRP at Tier OT1: $101 to $3,133.70 for a product vulnerability in the framework's own code, set by a discretionary panel, with the $13,337 figure belonging to the separate supply-chain-compromise category. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security bugs in the latest versions of code held in Google-owned GitHub organisations, and its tier file names all four ADK bindings at OT1: google/adk-python , google/adk-go , google/adk-java and google/adk-js . A product vulnerability anywhere in those four repositories is priced at $101 to $3,133.70, with no component carved out The agent runtime: the runner loop, the event stream a turn produces, and the invocation context that carries state from one step to the next Tool registration and dispatch, covering function tools, the argument binding that turns model output into a real call, long-running tools and the agent-as-a-tool wrapper The built-in tools the framework ships, including the code-execution and shell tools, file and retrieval tools, and whatever sandboxing sits around them MCP integration on both sides of the wire: the client toolsets ADK connects out with, and the MCP server ADK can expose Toolsets generated from an OpenAPI specification, and the credential and auth handling that attaches a token to an outbound tool call Multi-agent composition: sub-agent delegation, agent transfer, and the sequential, parallel and loop workflow agents Session, memory and artifact services, and every storage backend they ship with, from in-memory through database to the managed ones Callbacks and plugins, the framework's own interception points and the place a developer's guardrails are implemented The adk CLI, the local adk web UI, and the API server ADK stands up to serve an agent over HTTP The evaluation harness and the deployment helpers that package an agent for a hosted runtime Out of scope Prompt injection framed purely as model behaviour rather than as a failure of a framework control, which the program routes to the Google AI VRP instead Vertex AI and Gemini API service-side issues, which belong to the Cloud or AI VRP Third-party tools and MCP servers the developer chose to connect, which are their authors' code and not the framework's Agent output that is merely wrong or undesirable, with no concrete security boundary crossed Developer-machine-only issues in adk web absent a realistic attack path to reach them Repositories the tier file does not name, and releases that are not current: the program covers the latest versions of the listed repositories, and any other repository in the same organisation counts only where the file names it. What the file omits sits at OT2 or OT3, where product vulnerabilities earn no monetary reward Reports filed by anyone other than the researcher: Google requires the submission under your own identity through bughunters.google.com, and treats routing around the designated channel as grounds to reject Awards to researchers on sanctions lists, in territories subject to sanctions, or located in Russia or Belarus, which Google states it will not issue Most-valued findings A path from model-chosen tool arguments to code execution the developer never authorised: an escape from the built-in code-execution or shell tool's sandbox is the clearest form, and code execution is 40% of the recorded distribution and the class that reaches the top of the band MCP integration flaws where a connected server's response crosses back into the agent process as something more than data: tool definitions, arguments or artifacts that steer execution rather than informing it Multi-agent delegation boundary failures, where a sub-agent reaches a tool, credential or session that the delegating agent's configuration was meant to withhold: access control is 25% here Injection into the framework's own dispatch layer rather than into the model: argument construction, path handling or command assembly that a model-supplied string can steer, which is the version of injection that stays in scope, at 20% Session and artifact storage flaws that let one user's conversation history, uploaded files or credentials surface in another user's agent run Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. All four bindings are rated TIER_OT1, where a product vulnerability caps at $3,133.70; the $13,337 ceiling requires a supply-chain compromise of the repository or release pipeline, which is a different reward category Prompt injection framed as model behaviour is out of scope and may be routed to the Google AI VRP: to land here the finding has to be a failure of a control the framework itself implements Vertex AI and Gemini API service-side issues belong to the Cloud or AI VRP rather than to the open-source program, even when you reached them through ADK The award is set by a discretionary panel, so the band is a range and what moves you up it is a demonstrated crossing of a concrete security boundary, not an agent behaving badly Take the flaw to Google before anyone else: the VRP treats private disclosure to a third party for purposes other than fixing the bug as grounds to refuse the reward Disclosure Coordinated through Google Bug Hunters, with the fix shipping in a release of the affected binding: the Python advisory history sits against the google-adk PyPI coordinate. Because the program's rules can be read as barring a third-party hand-off before the fix, file with Google directly and hold the detail until the release is out; a framework fix only helps once the applications built on it upgrade. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability