Google ADK 2.14 promotes 42 components to stable and tightens shell execution against prompt injection

What shipped

Google released version 2.14.0 of its Agent Development Kit on November 7, according to a dev.to analysis of the official release notes. ADK is Google's open-source framework for building multi-agent systems, written Python-first with TypeScript, Java and Go ports, and this release promoted 42 components out of experimental status in one go: 26 modules covering authentication, environments, app management, the CLI and caching, plus 16 toolset integrations.

The dev.to post, which draws on the ADK release notes published on GitHub and a secondary report from Emergent, says the stable graduation covers execution environments, A2A support, evaluation tooling and core runtime modules.

A hardened shell boundary

The change the dev.to author argues will matter most over time is a quiet one. RunSkillScriptTool previously accepted a free-form shell command, meaning a model manipulated through prompt injection could push arbitrary commands onto the host shell. That path is now closed: callers pass structured arguments, short options and positional arguments instead, scripts must live in a validated skill directory, and execution is restricted to .py, .sh and .bash files.

The post frames this as agent frameworks relearning a lesson web frameworks absorbed years ago: model output should never reach a shell without a structured boundary in between. Existing code that still hands the tool a raw command string will now fail with an INVALID_ARGUMENTS error.

Evaluation gets honest about nondeterminism

Two evaluation features stand out. MultiRunConfig runs each evaluation case several times concurrently — through adk eval with a --num_runs setting and a --parallelism flag — and aggregates scores and pass rates across the runs. The dev.to author notes that evaluating an agent once was always unreliable given that identical runs can produce different behaviour, and this builds the fix into the framework.

The second feature, ToolArgsMatcher, validates the arguments a model passes to its tools in four modes: exact matching, case-insensitive matching, numeric tolerance and LLM-backed semantic matching. The semantic mode is the notable one, checking whether arguments carry the right intent even when the wording differs, which the post says reduces false negatives during evaluation.

Teams, memory and smaller additions

A new TeamsRunner embeds ADK agents directly inside Microsoft Teams. The reasoning, per the dev.to write-up, is that agents are most useful where workplace conversations already happen rather than in a separate console nobody opens.

Elsewhere, the release adds a MongoDbMemoryService with vector-search retrieval and TTL-based expiry for agent memory, an adk generate_agent_card CLI command, and an OpenAI Decisions integration.

The performance claim, with caveats

Google reports that a 30-node workflow running 200 turns is 23% faster with 9% lower peak memory in 2.14.0. The dev.to author urges caution here: the release notes publish no baseline hardware, do not name the prior version used for comparison, and offer no second benchmark. The number should be treated as directional until someone reproduces it on their own workload.

Breaking changes before upgrading

Three are worth watching. Enum tool arguments now arrive as enum members rather than raw strings. VertexAiSessionService raises a ValueError when it receives unrecognized keyword arguments. And the RunSkillScriptTool rework means anything still passing a command string is rejected outright.

Why it matters

Most agent-framework releases amount to a pile of new integrations. This one reads more like a maturity statement: a large block of stable APIs, evaluation tooling that accounts for nondeterministic behaviour, and a hardened execution boundary — the ingredients production deployments actually require before agents can be trusted with real work.

The Teams runner will attract the attention, but the shell-boundary fix addresses the class of prompt-injection vulnerability that has kept agent frameworks out of trust-sensitive environments. It also signals where the ecosystem is heading: away from experimental APIs and toward the stability and security posture expected of infrastructure software.

Open questions remain, as the dev.to post notes: whether independent benchmarks confirm the 23% speedup, how painful the skill-script migration proves for existing users, and whether ADK, with its core now stable, starts competing on developer experience rather than capability checklists.