Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.
AgentDossier · AI Agent Registry Find agents you can actually trust - public or inside your enterprise.

Traces / TR-2026-004

agent was the target · researcher disclosure · unreviewed

Gemini CLI: a README plus an allow-list bypass gives silent command execution

A repository README carries hidden instructions; a benign command the user had allow-listed is chained with a second command that exfiltrates environment variables, with output padded so the user sees nothing. Fixed in Gemini CLI 0.1.14.

Export STIX 2.1 Export JSON Request a correction (GitHub issue)

Timeline

2025-07-28 Tracebit discloses the Gemini CLI allow-list bypass; Google has fixed it in 0.1.14 · Tracebit T2

What defenders can take from it

  1. An allow-listed command is not a safe command once an agent can append to it — validate the full command, not a prefix.
  2. A file in the opened repo is untrusted input to a coding agent; a README can carry the attack.

The maintainer's reading of the public reports, not advice specific to your deployment.

Sources · 1

Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.

Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.