A README was enough to make Gemini CLI run attacker commands

Google's Gemini CLI could be made to execute arbitrary shell commands and quietly send a developer's environment variables to a remote server, security firm Tracebit disclosed in July 2025. The attack required only that a developer point the tool at a repository containing a crafted README file.

Tracebit combined two weaknesses. The first was indirect prompt injection: instructions placed in a file the agent read as context. The second was in the CLI's command allow-listing. Once a user approved a harmless command such as grep, the tool's validation could be tricked into running a much longer command string that began with the approved prefix but continued with additional commands separated by a semicolon.

The researchers demonstrated exfiltration of environment variables, which in a typical developer setup include API keys and cloud credentials. They also showed that the malicious command could be padded with whitespace so that the visible confirmation prompt did not reveal what would run.

Google was notified in June 2025 and fixed the issue in Gemini CLI version 0.1.14, released on 25 July. The fix tightened command parsing and added clearer warnings about executing commands from untrusted repositories.

Tracebit said the same technique did not work against several competing coding agents it tested, because they either parsed commands more strictly or required per-command confirmation. Gemini CLI had been released as open source only a month earlier.