AI SECURITYLABS

Security for Gemini Development: It wasn't a one-off

Part 5 of 16

It wasn’t a one-off

  • An allowed command, chained: Tracebit hid instructions in a file presented as a licence, then ran an allowed grep followed by “a command to silently exfiltrate all the user’s environment variables” (Tracebit, fixed in 0.1.14).
  • A key in a public comment: researchers used issue text to make the Gemini CLI Action post its GEMINI_API_KEY in a public issue comment (Comment and Control).
  • One user configuring everyone: Cymulate showed a standard Windows user planting a session-start hook in C:\ProgramData\gemini-cli for every user; Google said it would be “addressed as a documentation update” (Cymulate).
  • An extension swapped after pinning: AIR Security replaced a commit-pinned Gemini CLI extension with different code and reported no fix (Plugin4Shell).