AI SECURITYLABS

Security for Gemini Development: The impact

Part 6 of 16

The impact

  • Secrets out of CI: CVE-2026-12537 and Comment and Control both put workflow secrets within reach of whoever wrote the issue or pull request.
  • Environment variables out of laptops: Tracebit’s chain sent every environment variable, often including API keys, to an attacker without a prompt.
  • Every user on a machine: the ProgramData hook runs for anyone who starts Gemini CLI on that computer.
  • Code you didn’t review: a swapped extension brings its own MCP servers and hooks into every session.
  • Risks that stay open: the ProgramData and Plugin4Shell findings had no code fix, so the mitigation is yours to apply.