Google Patches Critical Vulnerability in Gemini CLI Tool
AI-generated from multiple sources. Verify before acting on this reporting.
LONDON (AP) — Google has issued a security patch for a critical vulnerability in its Gemini CLI tool that allowed attackers to execute arbitrary code and launch supply chain attacks by exploiting a defect in the tool's -yolo mode.
The flaw, identified by researchers at Pillar Security, stemmed from the CLI tool ignoring configured tool allowlists when operating in -yolo mode. This security setting, designed to allow for rapid development and testing, inadvertently created a pathway for malicious actors to bypass safety controls.
The vulnerability could have been exploited through malicious prompts embedded in GitHub issues. Attackers could potentially trick developers into running the Gemini CLI tool on compromised repositories, leading to unauthorized code execution on their local machines or within their development environments.
The issue was disclosed on May 7, 2026, prompting Google to release an immediate update to address the defect. The company advised all users of the Gemini CLI tool to update to the latest version to mitigate the risk of exploitation.
Pillar Security researchers detailed the mechanics of the vulnerability in a public advisory. They explained that the -yolo mode, which stands for "you only live once," is intended to bypass certain safety checks to facilitate faster iteration. However, the implementation failed to properly enforce tool allowlists, which are meant to restrict the tools the AI can access and execute.
This oversight meant that even if a developer had configured specific tools to be allowed, the -yolo mode would ignore these restrictions. Consequently, an attacker could craft a prompt that instructed the Gemini CLI to execute commands outside the permitted scope, potentially gaining control over the developer's system.
The vulnerability highlights the risks associated with AI-powered development tools that integrate directly with code repositories. As these tools become more prevalent in software development workflows, the potential attack surface expands, requiring robust security measures to prevent exploitation.
Google's response to the vulnerability included not only a patch but also recommendations for users to review their configurations and ensure that safety controls are properly enforced. The company emphasized the importance of keeping development tools updated to protect against emerging threats.
Security experts noted that while the vulnerability was critical, the window for exploitation was limited due to the rapid response from Google. However, the incident serves as a reminder of the need for continuous vigilance in securing AI-driven development environments.
The full extent of any potential exploitation prior to the patch remains unclear. Researchers are continuing to monitor the situation for any signs of active exploitation or related vulnerabilities in similar tools.
Developers are urged to update their Gemini CLI installations immediately and review their security configurations to ensure that tool allowlists are functioning as intended. The incident underscores the importance of balancing development speed with security in AI-powered workflows.