Google ADK 2.14 Graduates 42 Components to Stable - and Quietly Closes a Prompt-Injection Hole

Google shipped Agent Development Kit 2.14.0 on November 7, and the headline isn't the feature list - it's what the release says about where agent frameworks are headed: out of the experimental phase, into production, and with the shell-execution boundary finally getting serious treatment.

What happened

ADK is Google's open-source framework for building multi-agent systems (Python first, with TypeScript, Java, and Go ports). Version 2.14.0 graduates 26 auth, environment, app, CLI, and cache modules - plus 16 toolset integrations - from experimental to stable. That's 42 components leaving the "might change" zone in a single release.

The release notes summarize it as graduating "execution environments, A2A, evaluation, and core runtime modules from experimental," adding "multi-run evaluation and semantic tool argument matching," adding "Microsoft Teams and OpenAI Decisions integrations," and making "long multi-turn workflows faster."

The details that matter

Agents move into Teams. A new TeamsRunner puts ADK agents inside Microsoft Teams. The bet is obvious: agents are most useful where the work conversation already happens, not in a separate console nobody opens.

Evals get serious about nondeterminism. MultiRunConfig runs each evaluation case multiple times concurrently (adk eval --num_runs, with a --parallelism flag) and combines scores and pass rates across runs. Single-run evals of agents were always a coin flip; this is the framework admitting it and building the fix in.

Tool arguments get semantic checking. The new ToolArgsMatcher validates tool-call arguments in four modes:

• exact
• case-insensitive
• numeric tolerance
• LLM-backed semantic matching

The last one is the interesting one - it checks whether the arguments carry the right intent even when the phrasing differs, cutting false negatives in evals.

The quiet security fix. RunSkillScriptTool no longer accepts a free-form shell command. Callers now pass structured args, short_options, and positional_args, scripts run from a validated skill directory, and only .py, .sh, and .bash are allowed. This closes a real hole: a prompt-injected model could previously get arbitrary shell commands executed through the tool. Agent frameworks are slowly learning the same lesson web frameworks learned a decade ago - never let model output anywhere near a shell without a structured boundary.

Smaller additions: MongoDbMemoryService with vector-search retrieval and TTL expiry for agent memory, an adk generate_agent_card CLI command, and an OpenAI Decisions integration.

The performance claim, with a grain of salt

Google says a 30-node workflow running 200 turns is 23% faster with 9% lower peak memory in 2.14.0. The release notes publish no baseline hardware, no named prior version for comparison, and no second benchmark. Treat it as a directional claim until someone reproduces it on their own workload.

Breaking changes before you upgrade

Three to watch:

1. enum tool arguments now arrive as enum members instead of raw strings;
2. VertexAiSessionService now raises ValueError on unrecognized keyword arguments;
3. and the RunSkillScriptTool change above - anything still passing a command string gets INVALID_ARGUMENTS.

Why this release is worth noting

Most agent-framework releases are a pile of new integrations. This one reads more like a maturity statement: stable APIs, honest evals, a hardened execution boundary, and agents embedded in the tools teams already use. The Teams runner will get the attention, but the security fix is the part that will age best.

Open questions: will independent benchmarks back up the 23% claim? How painful is the skill-script migration for existing users? And now that the core is stable, does ADK start competing on developer experience rather than capability checklists?

Sources: the ADK 2.14.0 release notes on GitHub (google/adk-python releases) and https://emergent.sh/news/google-adk-2-14-adds-teams-integration-multi