website SEOWebsite Traffic
Google’s Gemini CLI tool was found to be seriously vulnerable within 48 hours of its launch. Researchers discovered how attackers could use prompt injection attacks to execute destructive commands and steal sensitive data without users noticing.
The attackers were able to hide malicious commands by adding lots of white space to the command lines, so that only the innocent part was visible in status messages. This allowed them to send environment variables to servers under their control without being noticed, information that often contains system settings and account details.
Sam Cox, founder of security company Tracebit, warns of the significant danger posed by this vulnerability. “The same technique works for extremely destructive commands such as ‘rm -rf /’ or fork bombs that crash systems. That’s exactly why I find this so worrying,” Cox said. Other similar tools from Anthropic and OpenAI were not found to be vulnerable to the same flaw.
Gemini CLI was only recently launched. It is a free open-source AI tool that helps developers write code in the terminal. It uses Google’s most powerful Gemini 2.5 Pro model. Researchers at Tracebit managed to bypass the built-in security measures via a seemingly innocent code repository.
The attack is difficult to detect because attackers hide their instructions in README.md files of packages. Gemini CLI reads these files to understand the code, allowing natural language commands in README files to mislead the AI into performing dangerous actions.
The researchers exploited a critical weakness in the allow list mechanism. Gemini CLI blocks commands by default unless users explicitly give permission. Using prompt injection, attackers were able to get users to add the relatively harmless grep command to their allow list.
Once approved, the attackers added additional commands to the same line, separated by semicolons. The system only checked the first grep part against the whitelist, while the subsequent env and curl commands were given free access to system information.
Google classified the vulnerability as Priority 1 and Severity 1, the most serious possible rating. The company released a fix last week that blocks the attack technique. Gemini CLI users should upgrade to version 0.1.14 and only run untrusted codebases in sandbox environments.
AI / CLI / cybersecurity / Gemini / Google / prompt injection
"*" indicates required fields
Update, 3:50 PM: Palo Alto Networks has now officially confirmed it i…
Microsoft is investing in European language technology with new AI in…
We hear all the time that cyber attackers no longer hack, but simply …
Social engineering is now responsible for 39% of all successful attem…
How does your SOC know which threats are real? Reducing noise is essential, according to Vectra AI. New findi…
Update, 3:50 PM: Palo Alto Networks has now officially confirmed it is buying CyberArk. The acquisition fee h…
We hear all the time that cyber attackers no longer hack, but simply log in. This is because it is true. Howe…
Today’s data and business analysts are equipped with a wide array o…
In an era where video security and digital technologies are evolving …
In recent years, there has been a seismic shift away from traditional…
The global push to regulate Artificial Intelligence (AI) is gaining m…
How do you ensure your company data is both secure and quickly recove…
“A Buyer’s Guide to Enterprise Linux” comprehensively analyzes the mo…
The Data Protection Guide 2025 explores the essential strategies and…
The white paper “DNS Best Practices” by Infoblox presents essential g…
Techzine focusses on IT professionals and business decision makers by publishing the latest IT news and background stories. The goal is to help IT professionals get acquainted with new innovative products and services, but also to offer in-depth information to help them understand products and services better.
© 2025 Dolphin Publications B.V.
All rights reserved.