Google ADK ships tool-confirmation forgery fixes to the v1 line and strips shell execution from ReadFileTool
google/adk-python v1.38.0 and v2.6.3, both published 2026-08-07, carry a pair of agent-authorization fixes. PR #6575 ports "prevent continuation forgery in tool confirmation" — now validating that a confirmed target tool is actually registered in the executing agent's tools_dict, that it genuinely requires confirmation, and that the original tool-call event exists in session history with matching ID, name and arguments — plus a fix that stops already-consumed confirmations from being re-validated on later LLM steps in the same turn. PR #6597 removes shell execution from ReadFileTool ranged reads and keeps local environment file access inside the workspace. The pattern across ADK and Agno this week is identical: approvals that were checked against model-supplied identifiers rather than server-held state.
↳ Follow the thread