Agents
ADK for Go 2.4.0 pins fetched A2A agent cards to their origin and finally puts auth on the REST API
Google shipped adk-go v2.4.0 on 2026-09-11 with two security-relevant changes among roughly 50 commits: a fetched agent card's interface URLs are now pinned to the origin the card was fetched from (PR #1418), closing a redirect path where a hostile card could point an agent at a different service, and the adkrest REST API gains authentication and authorization (PR #1561), which it previously lacked. Other fixes stop the ParallelWorker ignoring fail-fast under maxConcurrency, keep consent URIs and caller identifiers out of error text, and stop mcptoolset dropping non-text tool results.
↳ Follow the thread