AI SECURITYLABS

Security for Gemini Development: What goes wrong

Part 3 of 16

What goes wrong

Most serious findings against Gemini share one pattern: text the agent reads gets it to run a command it was allowed, or trusted, to run. The main risks are:

  • Trust given too easily: a trusted folder’s settings, .env and MCP servers load, and headless runs used to trust every workspace.
  • Confirmations removed: YOLO mode, broad tools.allowed entries, trusted MCP servers or policy allow rules.
  • Injected instructions: issues, context files and tool output steer the agent, including in CI.
  • Machine-wide configuration: on Windows, a folder any user can create configures every user.
  • Extension supply chain: MCP servers and extensions are third-party code running with your rights.