AIR-2025-0065 · Gemini CLI: allowlist parsing flaw plus context-file prompt injection enabled silent command execution and data exfiltration

Gemini CLI: allowlist parsing flaw plus context-file prompt injection enabled silent command execution and data exfiltration

AIR-2025-0065 AIR record · 2025-07-gemini-cli-tracebit-hijack

From the supporting source

Inspecting untrusted code consistently leads to silent execution of malicious commandstracebit.com

The record

Disclosed

2025-07-28

Vendor

Google

Product

Gemini CLI

Risk domain

Privacy › Data exfiltration channels

Also touches

Credential theft, Privilege escalation, Confused deputy

System type

Generative model

Who acted

Agent acted — Gemini CLI silently executed the chained command and exfiltrated

Attack surface

Coding agent

Autonomy level

Copilot with approval

Initial vector

Indirect prompt injection repo context file

Impact type

Remote code execution, Data exfiltration, Credential theft

Confidence

High

Submitted by

EAI Internal

Crosswalk

OWASP Agentic Top 10 (2026): ASI02 – Tool Misuse and Exploitation
MITRE ATLAS: AML.T0024 – Exfiltration via AI Inference API
NIST AI RMF: MAP 4.2
EU AI Act: Article 10
ISO/IEC: TR 24028; 23894
AIUC-1: A. Data & Privacy
Scope: tool misuse
Mitigation: Monitor network traffic for anomalous patterns; Restrict egress destinations.
Taxonomy: Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery

Blast radius

Gemini CLI versions before 0.1.14 (the tool had been released 2025-06-25)

Capability abused

shell_executionauto_context_ingestioncommand_allowlisting

Defense & remediation

Recorded defense

per-command user approval with an allowlist of trusted commands

Guardrail kinds

Human approval, Permission scope

Guardrail outcome

Silent

Fix shipped

Gemini CLI 0.1.14, released 2025-07-25 (reported 2025-06-27, two days after launch)

Curator notes

Tracebit. The injection was hidden inside GPL license text in README.md/GEMINI.md; because the chained command string began with an allowlisted 'grep', the whole command was treated as approved and ran with no prompt, exfiltrating environment variables to an attacker server. Asking 'tell me about this repo' was sufficient to trigger it.

Cite as

Enkrypt AI. "Gemini CLI: allowlist parsing flaw plus context-file prompt injection enabled silent command execution and data exfiltration". AIR, AIR-2025-0065. https://agentincident.vercel.app/i/AIR-2025-0065/ (accessed 2026-10-19).