Cases › security breach › LR-2026-0491

Google Gemini CLI flaw enabled host code execution and supply chain attacks

Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report

Status: fix reported

Severity moderate

Reported 30 Apr 2026

Developer and model Google

Agent tool Gemini CLI

Could do run shell command

No source states: loss or records, deployer, industry.

Severity moderate: bounded scope stated; Google said the impact is limited to workflows using Gemini CLI in headless mode

Google's Gemini CLI, an AI agent distributed as an npm package and a GitHub Actions workflow, had a flaw that could let an unprivileged external attacker run commands on the host. In headless mode the tool automatically trusted workspace folders when loading configuration, so planted configuration could execute code before the sandbox started. A separate bypass let prompt injection run shell commands in --yolo mode even where allowlists were set. Novee Security and Pillar Security reported the issues. Google's advisory said the impact is limited to workflows using Gemini CLI in headless mode. The update requires folders to be explicitly trusted and enforces tool allowlists under --yolo mode, and users were urged to review their workflows and set a trust variable depending on whether their inputs are trusted.

What happened

1 · What it was doingGemini CLI running headless in CI automatically trusted workspace folders when loading configuration.

2 · What went wrongPlanted configuration could run code on the host running the agent, turning CI/CD pipelines into supply-chain attack paths.

3 · What it reached or didHidden instructions in a GitHub issue could make the agent extract workflow secrets and send them to an attacker-controlled server.

4 · How it was caughtPillar Security researcher Dan Lisichkin was credited with discovering and reporting the allowlisting bypass.

What was done

The update requires folders to be explicitly trusted before configuration files can be accessed.

Fix reported

“"In version 0.39.1, the Gemini CLI policy engine now evaluates tool allowlisting under --yolo mode, which is useful for CI workflows that allowlist a few safe commands to run when processing untrusted inputs," Google said.”

Tool allow-list

No later incident for Google under this risk on record.

Risks

Hidden instructions hijack the agent
Primary50 incidents
Rising: 6 vs 2.8 a week

Supply-chain compromise
Also24 incidents
Rising: 4 vs 0.2 a week

Read from the sources; not yet reviewed by a person.

Controls

Harness

Not effective (bypassed) Sandboxed code execution
Not effective (bypassed) Tool allow-list

Application

Did not exist Human approval for high-impact actions

Control failure chain

L1 · Model Not stated in sourcesGoogle

L2 · Harness Not effective (bypassed)Gemini CLI

L3 · Application Did not existDeployer not named

L4 · Infrastructure / target Not stated in sourcesOrganisation hit

L1 · ModelGoogleModel provider

No source mentions a control at this layer.

Model version not linked to a model card.

L2 · HarnessGemini CLIAgent framework vendor

Not effective (bypassed)Sandboxed code execution“This triggered command execution directly on the host system, bypassing security before the agent’s sandbox even initialized.”The Hacker News

Not effective (bypassed)Tool allow-list“The tech giant also noted that it's taking steps to harden tool allowlisting when Gemini CLI is configured to run in --yolo mode to prevent scenarios where untrusted inputs (e.g., user-submitted GitHub issues) could lead to remote code execution via prompt injection by taking advantage of the fact that the auto-approve mode would ignore any allowlist in "~/.gemini/settings.json" and run all tool calls automatically (including "run_shell_command") without requiring user confirmation.”The Hacker News

Other controls for this risk at this layer, not mentioned in the sources: Outside content treated as data, not instructions, Prompt-injection detection, Confirmation after untrusted input, Validation of tool inputs and outputs.

L3 · ApplicationDeployer not namedDeployer

Did not existHuman approval for high-impact actions“This automatic trust of the current workspace folder meant that the tool could load any agent configuration it found without review, sandboxing, or explicit user consent.”The Hacker News

Other controls for this risk at this layer, not mentioned in the sources: Least-privilege access for the agent, Segmentation of agent components, Alerts on unusual tool use.

L4 · Infrastructure / targetOrganisation hit

No source mentions a control at this layer.

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

Controls for this risk: result in this incident

Control	Part of the system	Result
Tool allow-list	L2 Harness	Not effective (bypassed)
Sandboxed code execution	L2 Harness	Not effective (bypassed)
Confirmation after untrusted input	L2 Harness	Not stated in sources
Outside content treated as data, not instructions	L2 Harness	Not stated in sources
Prompt-injection detection	L2 Harness	Not stated in sources
Validation of tool inputs and outputs	L2 Harness	Not stated in sources
Human approval for high-impact actions	L3 Application	Did not exist
Least-privilege access for the agent	L3 Application	Not stated in sources
Segmentation of agent components	L3 Application	Not stated in sources
Alerts on unusual tool use	L3 Application	Not stated in sources

Similar incidents

Gemini lock-screen flaw lets strangers send messages from locked Android phones2026-07-17

Russian-speaking threat actor uses Gemini CLI to migrate and operate a botnet controlling eight computers in a dental clinic2026-07-13

Google Vertex AI SDK flaw let attackers hijack model uploads via bucket squatting2026-06-16

Previously harmless Google API keys expose Gemini AI data2026-02-26

All cases of this kind ›

Evidence

What set it off hidden instructions in its input

No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause.

Show the full account: 5 items from the primary sources

What happened, in order

2026-05-07 The article was updated with additional insights from Pillar Security.

Not dated in the sources:

Google published an advisory stating the impact is limited to workflows using Gemini CLI in headless mode.
Novee Security reported the flaw in a Wednesday report.
Gemini CLI version 0.39.1 began evaluating tool allowlisting under --yolo mode.
The update required folders to be explicitly trusted before configuration files could be accessed.

Show every field, with its source and grade

The AI system

Developer

Google

C one secondary source states it

Software around the model

Gemini CLI

C one secondary source states it

Tools it was given

run shell command

C one secondary source states it

How much it acted alone

it acted alone, unwatched

C one secondary source states it

What happened

Earliest source we hold

2026-04-30

D inferred by us from the described behaviour, reason shown

What set it off

hidden instructions in its input

C one secondary source states it

Who caught it

an outside party

C one secondary source states it

Who was responsible

the model provider

C one secondary source states it

Who caused it

an outside attacker

C one secondary source states it

What went wrong

security breach

C one secondary source states it

AI agent

an AI agent acted

C one secondary source states it

What it did

Indirect prompt injection in a GitHub issue led the agent to extract workflow secrets and send them to an attacker-controlled server.

C one secondary source states it

primary risk

RK01

D inferred by us from the described behaviour, reason shown

secondary risks

RK06

D inferred by us from the described behaviour, reason shown

control chain

layer: L2; party: harness vendor; control id: E1; outcome: got around; quote: This triggered command execution directly on the host system, bypassing security before the agent’s sandbox even initialized.; source index: 0, layer: L2; party: harness vendor; control id: A6; outcome: got around; quote: The tech giant also noted that it's taking steps to harden tool allowlisting when Gemini CLI is configured to run in --yolo mode to prevent scenarios where untrusted inputs (e.g., user-submitted GitHub issues) could lead to remote code execution via prompt injection by taking advantage of the fact that the auto-approve mode would ignore any allowlist in "~/.gemini/settings.json" and run all tool calls automatically (including "run_shell_command") without requiring user confirmation.; source index: 0, layer: L3; party: deployer; control id: B1; outcome: missing; quote: This automatic trust of the current workspace folder meant that the tool could load any agent configuration it found without review, sandboxing, or explicit user consent.; source index: 0

C one secondary source states it

remediations

kind: fix; controls added: A6; quote: "In version 0.39.1, the Gemini CLI policy engine now evaluates tool allowlisting under --yolo mode, which is useful for CI workflows that allowlist a few safe commands to run when processing untrusted inputs," Google said.; source index: 0

C one secondary source states it

Impact

Severity

moderate

D inferred by us from the described behaviour, reason shown

Why this severity

bounded scope stated; Google said the impact is limited to workflows using Gemini CLI in headless mode

D inferred by us from the described behaviour, reason shown

Notes on gaps

The Gemini CLI flaw has no CVE identifier and no count of affected users or parties is stated. Control B2 was assigned to the folder-trust fix and A6 to the policy engine change as judgements. The Cursor vulnerabilities in the same article concern a different product and were excluded from this record.

LR-2026-0491 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON