Case gemini-cli-tracebit-hijackAgent hijackUnited States
Gemini CLI hijacked via poisoned README to silently exfiltrate credentials
Tracebit showed instructions hidden in README.md or GEMINI.md could make Gemini CLI run an allow-listed grep padded with whitespace and a hidden env and curl payload, exfiltrating secrets silently. Fixed in 0.1.14.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 28, 2025
- Location
- United States
- Target
- Google Gemini CLI
- Severity
- High
- Triggered by
- Sam Cox (Tracebit)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Tracebit showed instructions hidden in README.md or GEMINI.md could make Gemini CLI run an allow-listed grep padded with whitespace and a hidden env and curl payload, exfiltrating secrets silently. Fixed in 0.1.14.
Impact: Silent exfiltration of environment variables and credentials from developers analysing untrusted code in default settings; no exploitation reported
Who triggered it
Actor: Sam Cox (Tracebit)
Attribution: Responsible disclosure to Google; rated P1/S1 by Google during triage
Motive: Security research
How it happened
Attack vector: Indirect prompt injection in context files combined with weak command validation and a display bug that hid the trailing commands from the user
Root cause: Allow-list matching on command prefix plus inadequate parsing let chained shell commands run after an approved one
Timeline
- Tracebit reports the issue to Google
- Google escalates to P1/S1
- Gemini CLI 0.1.14 released with the fix
- Coordinated public disclosure
Response
Google patched Gemini CLI and improved command display and validation
Current status: Patched
Sources (open in a new tab)
- Tracebit tracebit.com
- BleepingComputer bleepingcomputer.com
- CyberScoop cyberscoop.com
Cite this case
Gemini CLI hijacked via poisoned README to silently exfiltrate credentials. AI Threat Watch, case gemini-cli-tracebit-hijack, Jul 28, 2025. https://aithreat.io/cases/gemini-cli-tracebit-hijack/
Permanent link: https://aithreat.io/cases/gemini-cli-tracebit-hijack/