Google Agent Development Kit (ADK) — agentic threat model

Not certain from the listing — The framework is model-agnostic; foundation model threats (such as prompt injection, adversarial examples, or model alignment issues) depend entirely on the specific LLMs integrated by the developer.

Not certain from the listing — Data operations, vector stores, and RAG pipelines are implementation-dependent, leaving the system vulnerable to data poisoning or exfiltration if the developer does not secure the data layer.

As an open-source orchestration framework, L3 is the primary attack surface. Vulnerabilities in the framework's planning, state management, or tool-calling mechanisms could allow attackers to hijack agent execution flows or poison agent memory.

Not certain from the listing — Deployment infrastructure and sandboxing are managed by the end-user, meaning insecure hosting environments could expose API keys or allow lateral movement if an agent is compromised.

Not certain from the listing — The directory listing does not specify built-in evaluation or observability tools, creating potential blind spots in monitoring agent behaviors and detecting anomalous multi-agent interactions.

Not certain from the listing — Compliance, identity management, and access control policies must be manually implemented by the developer, as the open-source framework does not enforce specific regulatory or security standards out of the box.

Because the framework is explicitly designed for multi-agent applications, it is highly exposed to L7 threats such as agent-to-agent trust abuse, cascading failures across agent chains, and unauthorized delegation of tasks.