Google shipped ADK 2.14.0 on November 7 and buried a prompt-injection fix inside the release notes while graduating 42 components — including the A2A protocol — to stable. The headline is the stability graduation. The thing worth acting on immediately is three breaking changes that will silently break existing workflows. If you run any ADK setup touching RunSkillScriptTool, enum tool arguments, or VertexAiSessionService, review the changes before running pip install --upgrade google-adk.
The Security Fix Nobody Announced Loudly
RunSkillScriptTool no longer accepts free-form command strings. The release notes are blunt about why: “This closes a hole that let a prompt-injected model run arbitrary shell commands.”
That is not marketing language. Any ADK agent that accepted external input — from a user, an API response, or another agent via A2A — and routed that input through a skill script was potentially exploitable. A prompt-injected model could construct a command string and execute arbitrary shell code. The fix restructures the interface entirely: callers must now pass args, short_options, and positional_args as separate structured parameters. Only .py, .sh, and .bash files in validated directories will execute. Anything still passing a legacy command string gets INVALID_ARGUMENTS.
# Before (breaks in 2.14 — also a security risk)
tool.run(command="python scripts/process.py --input data.csv")
# After (2.14 compatible)
tool.run(
args="scripts/process.py",
short_options={"i": "data.csv"}
)If you have skill scripts in production, audit them now. This is a breaking change and a security patch in one.
42 Components Graduated to Stable — What That Actually Unlocks
“Experimental” in ADK has always meant one specific thing: the API can change without notice, so you should not build production workflows on it. With 2.14, that warning lifts for 42 modules.
What is now stable: execution environments (LocalEnvironment, E2BEnvironment, DaytonaEnvironment), the full A2A integration, the evaluation stack, and 26 core modules across auth, app, CLI, and cache. Teams running ADK in production can now pin these dependencies without fear of an API reshuffle in the next release.
The evaluation improvements are worth noting. MultiRunConfig lets you run eval cases multiple times concurrently and aggregate scores — useful for catching nondeterministic model behavior that single-run evals miss. ToolArgsMatcher adds four comparison modes including LLM-backed semantic matching, which catches intent alignment even when tool argument phrasing drifts.
A2A Is Stable — What That Means in Practice
A2A graduating to stable in ADK 2.14 is the last missing signal for teams that have been waiting to build agent orchestration in production. The protocol has been under AAIF (Agentic AI Foundation / Linux Foundation) governance since August 2026, alongside MCP in the same neutral standards body. The clearest distinction: MCP handles vertical connectivity — agent to tool — while A2A handles horizontal coordination — agent to agent. Most production systems end up using both.
Practically, adk generate_agent_card now builds an A2A agent card from the CLI, making agent discovery straightforward for teams adopting the protocol. Signed Agent Cards (introduced in A2A v1.0) remain the trust mechanism.
The Other Two Breaking Changes
Enum tool arguments now arrive as enum members, not strings. This one is insidious because it will not necessarily throw an error — it will produce wrong behavior in any code that does string comparisons on enum tool arguments. If your tool handler checks if arg_value == "OPTION_A":, that condition now evaluates to False even when the user selects that option. Update comparisons to use the enum member directly: if arg_value == MyEnum.OPTION_A:.
VertexAiSessionService now raises ValueError on unexpected keyword arguments. Previously, extra kwargs were silently ignored. Now they throw at runtime. If your session config initialization has accumulated any extra parameters, audit them before upgrading.
Teams Runner and Performance
The 2.14 release ships TeamsRunner, connecting ADK agents directly to Microsoft Teams chats and channels. The enterprise case is straightforward: agents deployed where work conversations already happen face less adoption friction than agents requiring a separate console. The same ADK module still runs on Cloud Run, Agent Engine, or GKE — deployment target is a build-time switch, not a code rewrite.
On performance: Google reports a 30-node, 200-turn workflow runs 23% faster with 9% lower peak memory in 2.14. No baseline hardware specs were published, so independent verification is not possible, but the direction is consistent with the memory-efficient file streaming improvements to ReadFileTool in this release.
Upgrading
The three breaking changes are targeted and fixable. The security fix to RunSkillScriptTool is the most work if your agents use skill scripts extensively, but the structured argument interface is not complex. Check the ADK 2.14.0 release notes for full migration details, then review the detailed breakdown of the prompt-injection fix before upgrading:
pip install --upgrade google-adkThe PyPI package page lists the full dependency requirements for Python 3.11+.
