Does Gemini CLI have known security vulnerabilities?

The Injection has tracked 3 stories about Gemini CLI, none of them with a published CVE yet. Several cover attacks or research that apply to it; each story lists what to do.

What is the latest Gemini CLI security issue?

The most recent story is "HarnessSecurity-Bench: auto-approve lifts attack success to 95.6%" (info severity), disclosed October 6, 2026 by arXiv. HarnessSecurity-Bench tests nine security mechanisms across six coding agent harnesses and reports that enabling auto-approve raises attack success from 29.2% to 95.6%, while command denylisting cut attack effects with a utility gain.

Which attack techniques have been used against Gemini CLI?

Stories about Gemini CLI on The Injection most often involve coding agents, prompt injection, indirect prompt injection, detection. Each technique has a glossary entry with a definition and every related story.

Gemini CLI security

Google's open-source coding agent for the terminal, built on Gemini models.

The Injection has tracked 3 security stories affecting Gemini CLI since September 17, 2026 (benchmark 1, research 1, vulnerability 1), 1 rated high or critical. The most recent, disclosed October 6, 2026, is "HarnessSecurity-Bench: auto-approve lifts attack success to 95.6%".

Stories

High or critical

With a CVE

2026-10-06

Latest disclosure

Every Gemini CLI story

2026-10-06INFO
Benchmark · arXiv
HarnessSecurity-Bench: auto-approve lifts attack success to 95.6%
HarnessSecurity-Bench tests nine security mechanisms across six coding agent harnesses and reports that enabling auto-approve raises attack success from 29.2% to 95.6%, while command denylisting cut attack effects with a utility gain.
2026-09-18MED
Research · arXiv
Explosive prompts: dormant injections fire on 'thanks' in agents
Explosive prompts are dormant prompt injections that wait for a harmless trigger such as 'thanks'. A new paper reports 43% to 83% success on nine production agents, versus at most 3% for plain injections, and proposes the DeFuse detector.
2026-09-17HIGH
Vulnerability · AIR Security
Plugin4Shell: zero-click plugin RCE in four AI coding agents
Plugin4Shell is a zero-click remote code execution flaw in how Claude Code, Codex, GitHub Copilot and Gemini CLI install pinned plugins. AIR says Claude Code and Codex are fixed, Copilot is not, and Gemini CLI will not be patched.

Questions people ask

Does Gemini CLI have known security vulnerabilities?: The Injection has tracked 3 stories about Gemini CLI, none of them with a published CVE yet. Several cover attacks or research that apply to it; each story lists what to do.
What is the latest Gemini CLI security issue?: The most recent story is "HarnessSecurity-Bench: auto-approve lifts attack success to 95.6%" (info severity), disclosed October 6, 2026 by arXiv. HarnessSecurity-Bench tests nine security mechanisms across six coding agent harnesses and reports that enabling auto-approve raises attack success from 29.2% to 95.6%, while command denylisting cut attack effects with a utility gain.
Which attack techniques have been used against Gemini CLI?: Stories about Gemini CLI on The Injection most often involve coding agents, prompt injection, indirect prompt injection, detection. Each technique has a glossary entry with a definition and every related story.