Framework Watch: Google ADK 2.12 Stops OAuth2 Secrets Leaking Over Its Run Endpoints, Locks Dev Endpoints to Localhost, and Lets You Filter Tool Output Before the Model Sees It

Google released ADK Python 2.12.0 on October 13, 2026. It is a large release, with over 30 features and more than 100 bug fixes. Its highlights lead with performance and control, but several of the fixes are security changes that anyone exposing an ADK server should read.

Security fixes to check first

• Secrets in responses: the notes say ADK now will "stop OAuth2 secrets from leaking over /run, /run_sse, /run_live, dev_server, and session endpoints". A related fix redacts non-OAuth credential secrets from the auth request event.
• Who the user is: ADK will now "take the ADK user id only from an authenticated principal", so a request can no longer simply claim to be another user.
• Dev server exposure: mutating /dev and agent builder endpoints are now restricted to local clients by default. Built-in agents are only enabled when adk web is bound to loopback, and the dev server warns when bound to a non-loopback address. Separately, a new feature encrypts Google credentials stored in the session.
• Shell allowlist: the ExecuteBashTool allowlist now matches on whole shell tokens.
• Approvals: a confirmed tool now runs once per approval.
• Input handling: ADK now decodes URL-safe base64 strictly, so malformed input is rejected, and OIDC token exchange works without a client_secret.

New controls

after_tool_callback lets you intercept and filter tool outputs before they reach the model. That is a natural place to strip secrets, truncate huge payloads, or screen fetched content for prompt injection. Workflow nodes can now require human confirmation via require_confirmation, including in @node and FunctionNode. Agents can be deployed to Agent Engine with dedicated custom service accounts, and ADK now runs on Python 3.15. Smaller additions include a --state_file option for adk run, skill-level security support in AgentCardBuilder, and cancellation of sibling tools when one child call is cancelled.

Long sessions and agent-to-agent

The headline performance item is: "Cut time to first model request by 40% in long sessions." Several fixes target compaction, which now skips instead of failing when summarisation errors or a request cannot shrink, and no longer stays blocked by an orphaned function call. On A2A, paused tasks now resume on ordinary user replies, and the A2A part converter supports tool calls and tool responses.

What remains uncertain. The notes do not say whether the secret-leak and user-ID fixes were reported as vulnerabilities, which versions are affected, or whether any deployment was exposed. The release notes link no security advisory.

Analysis: If you run an ADK server reachable beyond your own machine, upgrade and then check two things yourself. First, call your run endpoints with an OAuth-backed tool and inspect the responses for credentials. Second, confirm user identity comes from your auth layer, not from the request body. The broader lesson for agent frameworks is that the dev server tends to become a production server. Defaults that assume localhost are only safe if the framework enforces localhost, which ADK now does.