{
 "public_id": "AIR-2025-0065",
 "incident_id": "2025-07-gemini-cli-tracebit-hijack",
 "date_disclosed": "2025-07-28",
 "date_occurred": null,
 "title": "Gemini CLI: allowlist parsing flaw plus context-file prompt injection enabled silent command execution and data exfiltration",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "indirect_prompt_injection_repo_context_file",
 "agent_capability_abused": [
  "shell_execution",
  "auto_context_ingestion",
  "command_allowlisting"
 ],
 "target_product": "Gemini CLI",
 "target_vendor": "Google",
 "autonomy_level": "copilot_with_approval",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution",
  "data_exfiltration",
  "credential_theft"
 ],
 "blast_radius": "Gemini CLI versions before 0.1.14 (the tool had been released 2025-06-25)",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI05"
  ],
  "mitre_atlas": [
   "AML.T0051.001"
  ],
  "labels": [
   "indirect_prompt_injection",
   "allowlist_bypass",
   "misleading_ux",
   "silent_execution",
   "readme_poisoning"
  ]
 },
 "defense_present": "per-command user approval with an allowlist of trusted commands",
 "defense_bypassed": true,
 "fix_shipped": "Gemini CLI 0.1.14, released 2025-07-25 (reported 2025-06-27, two days after launch)",
 "primary_sources": [
  "https://tracebit.com/blog/code-exec-deception-gemini-ai-cli-hijack"
 ],
 "verified_quote": "Inspecting untrusted code consistently leads to silent execution of malicious commands",
 "confidence": "high",
 "notes": "Tracebit. The injection was hidden inside GPL license text in README.md/GEMINI.md; because the chained command string began with an allowlisted 'grep', the whole command was treated as approved and ran with no prompt, exfiltrating environment variables to an attacker server. Asking 'tell me about this repo' was sufficient to trigger it.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Prompt Injection",
 "risk_sub_secondary": [
  "Credential & Secret Theft",
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "Gemini CLI silently executed the chained command and exfiltrated",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_repo_context_file",
 "guardrail_kind": [
  "human_approval",
  "permission_scope"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [
   "AML.T0051.001"
  ],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "gemini_cli",
 "model_provider": "google",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_exfiltration_channels",
 "eai_domain": "privacy",
 "eai_secondary": [
  "credential_theft",
  "privilege_escalation",
  "confused_deputy"
 ],
 "eai_reason": "impact rule: data_exfiltration_channels",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}