The question it answers
For every place Gemini Code Assist runs: if injected text hijacked the agent right now, what could it reach, and would you know? Everything below is a way of answering that question with evidence rather than assumptions.
Developer assessment (1 hour)
- Run the audit (about a minute). The Gemini Security Audit container checks your settings, policies, MCP servers, extensions, Code Assist setting and a project of your choice, offline and read-only. Save the HTML report.
- Work through the checklist. Items marked "manual" are the ones the audit cannot see: your licence, admin controls, workflow secrets and working habits.
- Compare against the common misconfigurations and fix every Critical one first.
- Prove the controls work with the ten-minute self-test below.
- Keep the evidence: the audit report, the completed checklist and the test results. Re-run after each upgrade and at least monthly.
The ten-minute self-test
Configuration you haven't tested may not do what you think. Make a throwaway project containing a fake .env, apply the baseline settings and policies, and try each of the following. Every one should be refused or stopped for your approval.
| Try this | What should stop it |
|---|---|
| Open the folder for the first time | Gemini CLI asks you to trust it and ignores its settings until you do |
| "Run rm -rf build" | The rm -rf policy rule denies it |
| "Push this branch" | The git push rule asks first |
| "Download https://example.com with curl" | The curl rule asks first |
Run gemini --yolo | disableYoloMode ignores it |
| "Write a script that connects to the database" | GEMINI.md: the script should read credentials from environment variables |
The settings and policies it tests are in the audit's fix section. Re-run it after every Gemini CLI upgrade.
Team assessment method
For a team or organisation, allow two to four weeks across 6 phases:
- Scope and inventory. List the surfaces in use (Gemini CLI, Code Assist in VS Code and JetBrains,
run-gemini-cliworkflows), licences, versions, MCP servers, extensions, hooks and policy files. Users on consumer tiers moved to Antigravity CLI and need a separate review. Useful sources: the Google Cloud console, EDR process inventory and a code search for.gemini/,GEMINI.mdandrun-gemini-cli. - Threat model. For each place Gemini runs (laptop, container, CI runner), write down the identities and credentials it holds and the data and systems it can reach. That list is your blast radius.
- Configuration review. Compare each developer's
~/.gemini/settings.json, policies and Code Assist settings, the machine-wide settings and the organisation's admin controls with the checklist. On each developer machine, the audit container does the local part in about a minute. - Technical testing. Try to break it, safely, in a test project: read a planted fake secret, reach a host that is not allowed, open a crafted repository with a
.gemini/settings.jsonand aGEMINI.mdinjection, and open a crafted issue against a staging repository that runs the Gemini CLI Action. Each attempt should be both blocked and detected. - Detection and response review. Confirm Code Assist audit logs are arriving in Cloud Logging; check that your alerts fire on the test activity from phase 4; run a tabletop for "the agent leaked a key" and "a workflow leaked its secrets".
- Report and roadmap. Record findings with their misconfiguration IDs, score each domain with the maturity model below, and write a plan that fixes them in order of risk, following the fix order.
Enterprise checklist
Use these as the evidence behind each maturity score.
Governance
- An approved policy for AI-assisted development, published and acknowledged.
- Named owners for admin controls, machine-wide settings, MCP and extension intake, detections and incident response.
- Controls mapped to the frameworks you report against (OWASP Top 10 for Agentic Applications, NIST AI RMF, ISO/IEC 42001, SOC 2 change management).
Identity and access
- Code Assist Standard or Enterprise licences assigned through groups and reviewed quarterly.
- Workflows authenticate to Google Cloud with workload identity federation, not long-lived API keys.
- Consumer-tier users moved off Gemini CLI to a governed tool.
Policy enforcement
- Admin controls set in the Google Cloud console: strict mode on, extensions and MCP limited.
- Machine-wide
settings.jsondelivered to/etc/gemini-cli,/Library/Application Support/GeminiCliorC:\ProgramData\gemini-cli, with the folder locked to administrators. - Admin policy files enforcing deny rules for destructive commands.
Data protection
- VPC Service Controls include the Gemini for Google Cloud and Gemini Code Assist APIs where required.
- Secret scanning with push protection on every repository; prompt logging reviewed against your data policy.
Endpoint and network
- EDR on every developer host, and inside WSL and dev containers where required.
- Corporate proxy and CA configured; an egress allowlist for model endpoints and package registries.
- A standard container with no credentials for untrusted code.
CI/CD and production
- Every
run-gemini-cliworkflow inventoried, pinned by SHA at 0.1.22 or later, and never run with--yoloon outsider input. - Workflow permissions and secrets limited to what each job needs; CODEOWNERS covers
.gemini/,GEMINI.mdand workflows. - No agent has standing write access to production; a break-glass procedure is documented.
Observability and response
- Code Assist audit logs (
cloudaicompanion.googleapis.com) retained according to policy; Gemini CLI telemetry exported where approved. - Detections for agent activity deployed and tested, including changes to
.gemini/files and new MCP servers. - Runbooks for a leaked key, an injected agent action, a malicious MCP server or extension, and a compromised workflow; a tabletop run in the last 12 months.
Threat intelligence and testing
- Gemini CLI and Code Assist advisories and research followed, with a regular summary for the team.
- The phase 4 tests re-run after each upgrade and policy change.
- Gemini in the scope of the annual penetration test or red team.
Maturity model
Score each domain from 0 to 4 and track it quarterly.
| Level | Name | What it looks like |
|---|---|---|
| 0 | Unmanaged | Personal accounts, no policy, no visibility. |
| 1 | Aware | Policy written; approved accounts; developers trained; some user-level settings. |
| 2 | Managed | Managed settings enforced across the fleet; sandbox on; MCP and plugin allowlists; telemetry on. |
| 3 | Monitored | Detections tested; CI agents separated from privileged jobs; version floor enforced; advisories drive patching. |
| 4 | Optimised | Attack tests run automatically in CI; metrics drive policy; agent identities fully scoped; production access denied by default and proven. |
A sensible first target for most organisations is level 2 everywhere, and level 3 for policy enforcement, isolation and CI/CD, because those three domains carry most of the critical risks.
Score it
Pick a level for each domain. The weighted score updates as you go; nothing is sent anywhere.
| Domain | Weight | Evidence to collect | Level |
|---|---|---|---|
| Governance | 10% | Policy, owners, framework mapping | |
| Identity and access | 15% | SSO and SCIM setup, login enforcement, CI identity | |
| Policy enforcement | 20% | Admin controls, machine-wide settings and policy files, audit reports | |
| Isolation (sandbox, containers) | 15% | Sandbox settings, phase 4 test results | |
| Supply chain (MCP, plugins, actions, packages) | 10% | Allowlists, pinning, intake records | |
| CI/CD and production | 15% | Workflow review, branch protection, production access review | |
| Observability and response | 10% | Telemetry proof, detections, tabletop | |
| Threat intelligence and testing | 5% | Advisory tracking, test runs |
Weighted score: 0.0 of 4 · Unmanaged
Sources
- Gemini CLI and Code Assist documentation: Configuration reference, Sandboxing, Trusted folders, Policy engine, MCP servers, Hooks, Code Assist agent mode, Google: transition to Antigravity CLI.
- Why each control matters, with incident sources: Common Gemini Misconfigurations.
- Frameworks: OWASP GenAI Security Project, NIST AI RMF, ISO/IEC 42001.
The domain weights and maturity levels are AISecurityLabs.org guidance, not a standard; adjust them to your risk profile. Informational only, with no guarantee of a vulnerability-free setup, so test every configuration in your own environment. AISecurityLabs.org is independent and not affiliated with Google.