Common Gemini Misconfigurations

Gemini CLI or run-gemini-cli running headless in CI on an old version, or with --yolo on outsider input.

Why it matters. Before 0.39.1, headless runs "automatically trusted workspace folders for the purpose of loading configuration and environment variables", and under --yolo ignored tool allowlists; workflows reviewing user-submitted pull requests were exposed (CVE-2026-12537, CVSS 3.1 10.0 by Google, 7.8 by NVD).

Fix. Update Gemini CLI to 0.39.1 and run-gemini-cli to 0.1.22, pin the action by SHA, and never run it with --yolo on outsider input.

Folder trust turned off, or every folder trusted without reading it.

Why it matters. A trusted folder's .gemini/settings.json, .env and MCP servers all load. An untrusted folder loads only four authentication variables and no MCP servers (Gemini CLI docs), so trust is what keeps a repository from configuring the agent.

Fix. Keep security.folderTrust.enabled on, and read .gemini/ and .env before trusting a folder.

Broad tools.allowed entries, such as the bare run_shell_command.

Why it matters. Tracebit hid instructions in a file presented as a licence, then used an allowed grep followed by a second command to send the user's environment variables to an attacker without a prompt; Google fixed it in 0.1.14 (Tracebit).

Fix. Allow only read-only commands, for example run_shell_command(git status).

No sandbox (the default), or a permissive one.

Why it matters. "Sandboxing is disabled by default", and on macOS the default Seatbelt profile, permissive-open, confines writes but allows broad reads and network access (Gemini CLI docs).

Fix. Turn on tools.sandbox, use a strict- Seatbelt profile or a container on macOS, and keep sandboxNetworkAccess off.

YOLO mode: --yolo, a shell alias, or Code Assist's agentYoloMode.

Why it matters. YOLO mode approves every action, and Code Assist agent mode has its own geminicodeassist.agentYoloMode setting (Gemini CLI docs, Code Assist docs).

Fix. Set security.disableYoloMode, keep agentYoloMode off, and remove aliases.

MCP servers with "trust": true.

Why it matters. trust makes Gemini CLI "bypass all tool call confirmations" for that server (Gemini CLI docs).

Fix. Remove "trust": true and keep confirmations on for every server.

MCP servers that read content outsiders can write.

Why it matters. Fake Sentry error events carrying "fix" instructions hijacked coding agents through an MCP server (Agentjacking, The Hacker News).

Fix. Give these servers read-only scopes and read what they return before acting on it.

The Gemini CLI Action running on issue and pull request text from outsiders.

Why it matters. Researchers hid instructions in issue titles, bodies and comments that made the Gemini CLI Action post its GEMINI_API_KEY in a public comment (Comment and Control).

Fix. Run the action only on input from trusted contributors, without --yolo, and with only the secrets it needs.

On Windows, C:\ProgramData\gemini-cli missing or writable by standard users.

Why it matters. Cymulate showed a standard user creating the folder and planting a system-defaults.json with a session-start hook that runs for every user; Google said it would be "addressed as a documentation update" (Cymulate).

Fix. Create the folder as an administrator before deploying Gemini CLI, remove write access for Users, and alert on changes to it.

Extensions installed from Git without restrictions.

Why it matters. Extensions bundle MCP servers, hooks and context files. AIR Security showed a Gemini CLI extension pinned to a commit being swapped for different code, and reported no fix for Gemini CLI (Plugin4Shell).

Fix. Set security.allowedExtensions or blockGitExtensions, and review each extension's manifest.

Context files merged without review.

Why it matters. GEMINI.md and AGENTS.md are loaded as instructions (Gemini CLI docs), and hidden Unicode can keep injected instructions out of a reviewer's sight (Pillar Security).

Fix. Put context files under CODEOWNERS and add a pre-commit check for hidden Unicode.

No policy rules, or allow rules for any shell command.

Why it matters. The highest-priority matching policy rule decides each call, and an allow rule runs matching calls without asking (Gemini CLI docs).

Fix. Deny destructive commands, ask before pushes and network commands, and never allow run_shell_command without a narrow prefix.

Hooks that download code, or hooks from someone else.

Why it matters. Hooks run commands with your privileges on events such as SessionStart and BeforeTool (Gemini CLI docs).

Fix. Read every hook, including those extensions and projects add, and remove any that download code.

Opening repositories with disguised symlinks or their own .git/config.

Why it matters. Adversa showed approval prompts in coding agents displaying a harmless link name while the write landed on the real target (SymJack). Git settings such as core.fsmonitor run programs during ordinary git commands.

Fix. List links and their targets, and re-clone repositories that arrived as archives or folders.