In late June, Google unveiled Gemini CLI, an open-source AI agent for command line terminals capable of supporting development workflows for projects like developing network applications. Just two days later, a major security flaw emerged.

Analysts at cybersecurity firm Tracebit uncovered a vulnerability that allowed threat actors to execute arbitrary malicious code on a user’s machine without their knowledge.

Gemini CLI supports executing shell commands – terminal commands that can perform various system operations. The AI-powered coding assistant tool also supports “context files,” which contain additional project-specific information written in natural language to help make the AI assistant more effective for coding tasks.

Tracebit found that attackers could exploit the system through a two-stage process: first, by hiding malicious instructions within seemingly innocent files disguised as legitimate content, then tricking users into approving harmless commands like 'grep' searches.

Once in the system, Gemini CLI would allow the malicious commands to be executed without requiring further user approval and quietly exfiltrate the user’s environment variables to a remote server.

Sam Cox, Tracebit’s co-founder and CTO, explained the hack in a blog post: “A user who runs Gemini against this payload is likely, though of course not certain, to have a very benign interaction, completely unaware that arbitrary code is executing on their machine to steal their credentials.”

Google billed Gemini CLI as an AI-powered coding tool capable of streamlining development workflows directly in the terminal environment. Powered by the hyperscaler’s flagship Gemini 2.5 Pro model, developers in the networking space could use it to analyze configurations or troubleshoot directly within their terminals.

But the terminal is deemed vulnerable to attack through a simple grep search, a process most AI coding applications would consider low risk. With just two inputs, the team at Tracebit was able to show that a user’s entire environment could be exposed, while leaving no indication that an attack even happened.

“Gemini will output all commands executed, even when they have been allowed by the whitelist to run automatically. A user who sees this command execute is likely to recognise it as malicious,” Cox wrote.

“Of course, by the time it has executed it is too late to stop, but an attacker will want to avoid detection and remediation if possible.”

In the month since Gemini CLI’s launch, Google has fixed the coding tool, with users attempting to run the same injection now able to see the malicious command, with approval required in order to run.

Despite the fix, Cox and the team at Tracebit said users of tools like Gemini CLI should put in place stringent guardrails and policies to prevent such attacks.

“We're naturally biased but believe that implementing 'assume breach' through security canaries can play an invaluable role in providing guard rails which provide low effort, low risk, high fidelity detections,” the CTO concluded.