Chronicle/Attacks & incidents

Tracebit shows Gemini CLI could silently run attacker commands when reading untrusted code

Jul 28, 2025AttackVulnerability disclosureSignificance assistant-drafted

Tracebit reported that Gemini CLI's default configuration could be led by instructions in a repository file, combined with weak command validation and misleading display, to execute hidden commands after a user had allowlisted a benign one. Google classified it P1/S1 and fixed it in Gemini CLI 0.1.14 on 2025-07-25.

Why it matters

Command allowlists in coding agents are only as strong as their parsing of what is actually run.

Key facts

As stated in the sources, with where to find them.

Reported 2025-06-27, two days after Gemini CLI's release; reclassified to P1/S1 on 2025-07-23; fixed in 0.1.14 on 2025-07-25.Timeline

Findings that cite this record

Jul 28, 2025

Approval gates in coding agents do not always show, or even ask about, what the agent is actually about to do.

Corroboratedmeasured2 evidence records

Jul 28, 2025

In several agent frameworks and coding tools, prompt injection in content the agent read reached code execution on the host, sometimes combined with a common setting such as an allowlisted command.

Corroboratedmeasured5 evidence records

Key questions this bears on

Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.
Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.

Sources

Code Execution Through Deception: Gemini AI CLI HijackTracebitJul 28, 2025Primary sourceAccessed Sep 25, 2026

Related records

Nov 20, 2025

PromptArmor shows Google Antigravity agent exfiltrating credentials from a poisoned web guide

AttackVulnerability disclosurePromptArmor, Google

Aug 6, 2025

SafeBreach shows Google Calendar invites can hijack Gemini for Workspace agents

AttackVulnerability disclosureSafeBreach, Tel Aviv University, Technion

Jan 19, 2026

Miggo finds Gemini calendar-invite injection that bypassed privacy controls on meeting data

AttackVulnerability disclosureMiggo Security, Google

Aug 12, 2025

GitHub Copilot agent could be prompt-injected into disabling its own approvals (CVE-2025-53773)

AttackVulnerability disclosureJohann Rehberger (Embrace The Red), Microsoft, GitHub

Aug 6, 2025

Zenity AgentFlayer: zero-click connector attacks on ChatGPT, Copilot Studio and other agents

AttackVulnerability disclosureZenity, OpenAI, Microsoft

Oct 20, 2025

Anthropic adds OS-level filesystem and network sandboxing to Claude Code and open-sources the runtime

DefenseTool releaseAnthropic

Organizations: Tracebit, Google
Topics: Prompt injection Sandbox & containment Data exfiltration
Attack surface: Untrusted content Execution sandbox Human approver
Methods: Restricting what agents can reach
Benchmarks and tools: Gemini
Fide research: FID-076: Authorization boundaries and AI control in cybersecurity
Record: gemini-cli-silent-code-execution-2025 · added 2026-09-25

Cite this record

Fide AI. "Tracebit shows Gemini CLI could silently run attacker commands when reading untrusted code." Agentic Cyber Explorer, record gemini-cli-silent-code-execution-2025. https://agentic-cyber-explorer.pages.dev/events/gemini-cli-silent-code-execution-2025/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-gemini-cli-silent-code-execution-2025,
  author = {{Fide AI}},
  title = {Tracebit shows Gemini CLI could silently run attacker commands when reading untrusted code},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/events/gemini-cli-silent-code-execution-2025/},
  note = {Record gemini-cli-silent-code-execution-2025; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Spotted an error? Suggest a correction.