Google ADK 2.14: stable agent APIs and a prompt-injection fix

Google's Agent Development Kit just told you which parts are safe to build on. ADK for Python 2.14.0 moves more than 40 auth, environment, toolset and integration modules out of experimental. It also closes a hole that let a prompt-injected model run any shell command it wanted. If you run ADK agents in production, upgrade. But read the breaking changes first, because one of them makes a rollback harder than it looks.

What actually happened

Google tagged ADK Python v2.14.0 on GitHub on November 7 (UTC). The release notes list:

• Stable APIs. 26 auth, environment, app, CLI and cache modules and 16 toolset and integration features leave experimental. That includes the A2A integration and the Local, Daytona and E2B execution environments.
• A prompt-injection fix. RunSkillScriptTool no longer accepts a free-form shell command in environment mode. The model now passes validated arguments, and only .py, .sh and .bash scripts run. Google's own words: this "closes a hole that let a prompt-injected model run arbitrary shell commands." A separate fix blocks exec gadgets in YAML configs.
• Steadier evals. adk eval --num_runs runs each test case several times in parallel and combines the scores. A new ToolArgsMatcher checks tool-call arguments with exact, numeric-tolerance or LLM-graded matching.
• New integrations. A TeamsRunner connects an agent to Microsoft Teams chats and channels. MongoDB memory gets vector search and a TTL setting.
• Speed. A 30-node workflow over 200 turns runs 23% faster with 9% lower peak memory, per Google's numbers.

Why the ADK 2.14 upgrade needs a plan

The security fix is the reason to move. A script tool that takes raw shell strings is an open door for any document, email or web page your agent reads. If you built on that pattern, your calls and eval sets that pass command now fail with INVALID_ARGUMENTS. Fix them on purpose.

Then check the traps:

1. Firestore sessions don't roll back. Sessions that 2.14 writes to FirestoreSessionService can't be read by 2.13.0 or earlier. Export your session data before you upgrade.
2. Enum tool arguments change type. Tools now get enum members, not raw strings. Code like arg == "refund" stops matching without an error.
3. Kill switches are gone. The 16 promoted features can no longer be turned off with ADK_DISABLE_* flags. If you used those flags as a guardrail, they now do nothing, silently.

Run your eval suite with --num_runs 5 before and after the upgrade. One passing run on a model that varies tells you very little. Same lesson as the ADK 2.7.0 patch: pin the version, then upgrade on your schedule, not on the next pip install.

Sources: Google ADK Python v2.14.0 release notes, ADK Python changelog.