Oct 17, 2026 · 32 min
Gemini CLI flaw exposed a path to GCP compromise
The wrong kind of access. [Research Saturday]
The case shows why AI agents handling untrusted input need enforceable controls over tools, operating systems, and identities—not just prompts.
- 1A malicious GitHub issue could trigger prompt injection and command execution through Gemini CLI’s GitHub Actions workflow.
- 2Exposed workload identity credentials and excessive service-account permissions turned CI access into a route toward GCP project compromise.
- 3Google closed the attack chain, but the broader lesson is that allowlists and system prompts are not security boundaries.
Don't miss
Lisichkin explains how the researchers moved past a failed credential-extraction attempt and induced Gemini CLI to execute arbitrary commands in the CI environment.
The brief
Dan Lisichkin of Pillar Security describes how a malicious GitHub issue reached Gemini CLI through a GitHub Actions workflow, turning untrusted text into a route for command execution.
The researchers found that Gemini CLI could be induced to run arbitrary commands in its CI environment, where exposed workload identity credentials and excessive service-account permissions threatened a GCP project.
An early attempt to extract a long credential file through the model failed because its size and format resisted reproduction, but the attack did not depend on that approach.
Google fixed the chain by blocking Gemini CLI’s access to the credential file and correcting the associated service account’s excessive permissions.
Lisichkin’s broader warning is sharper than the individual bug: agents processing untrusted input need scoped tools and operating-system and identity controls, not merely system prompts or allowlists.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.