The problem
What Gemini can reach
Gemini asks before tools run, but “Sandboxing is disabled by default” (Gemini CLI docs), so an approved command runs with your full user permissions. That includes ~/.ssh, ~/.aws and every .env file your account can open.
What Gemini loads matters as much as what it runs. ~/.gemini/settings.json, a trusted folder’s .gemini/settings.json and .env, GEMINI.md, MCP servers, hooks and extensions all instruct or execute, and every issue, web page and tool result can carry instructions aimed at the model.