AIA-006 Gemini CLI command execution via deceptive context file, per Tracebit

ID: AIA-006
Category: AI AI agent incident
Disclosed: 2025-07
Systems: Gemini CLI
Harm type: Prompt injection / code exec
Status: fixed
Tracebit reports the issue was fixed in Gemini CLI v0.1.14, released July 25, 2025.

Summary

Tracebit showed that Google's Gemini CLI could be led by a crafted README/context file to run hidden malicious commands under an allow-listed command. Tracebit reported it to Google on June 27, 2025; it was fixed in v0.1.14 (July 25) and disclosed July 28.

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

MEASURE 2.7 Security and resilience are evaluated and documented
MANAGE 2.4 Mechanisms exist to supersede, disengage, or deactivate the system

NIST SP 800-53

CM-7 Least Functionality
AC-6 Least Privilege
SI-10 Information Input Validation

Human-approval (JCR) checkpoint

yes: shell command approval

Sources

tracebit.com primary link checked 2026-10-31, HTTP 200
Reported June 27; fixed v0.1.14 July 25; disclosure July 28, 2025
https://tracebit.com/blog/code-exec-deception-gemini-ai-cli-hijack

Corrections

2026-10-28 Verification round 1: date month and summary verified against the Tracebit post. Added report, fix and disclosure dates. Status changed from reported to fixed (fixed in v0.1.14 per Tracebit).

To report an error in this entry, see corrections.