Gemini CLI Security: Sandbox, Trusted Folders, YOLO Mode and Antigravity CLI Security After the June 2026 Migration

The advisory is dry. The research behind it is not, and it is the clearest published illustration of why permission scope beats prompt hardening.

Pillar Security reported the issue to Google's open source vulnerability rewards program on April 16, 2026, submitted a full supply chain proof of concept against the gemini-cli repository itself on April 20, and Google published the advisory on April 24. The chain ran like this. An attacker opens a public GitHub issue containing hidden instructions. A Gemini-powered triage workflow reads the issue, because reading issues is its job. The injected instructions take control of the agent and have it read Git credentials out of .git/config and exfiltrate them. Those credentials carry actions:write, which is enough to trigger a second workflow against an attacker-controlled branch, and that second workflow yields a token with contents:write. At that point an outsider can push to the main branch of a repository with over 100,000 stars.

Nothing in that chain is a memory corruption bug or an exotic exploit. Every step is a tool the agent was legitimately allowed to use, invoked for a reason its operators never intended. The researchers' own summary of why the injection worked is the sentence worth taking into your next design review: "The model refused five researchers who asked for secrets by name. It ran our payload because we never mentioned secrets at all."

Read that as a boundary statement about detection. The model was trained to refuse the obvious phrasing, and it did. The payload simply did not use the obvious phrasing. Any control whose job is to recognize bad intent in text is playing a game where the attacker picks the words. Controls that constrain what the agent may do next are playing a game where you pick the rules. That is the argument for tool permissions over filtering, and we make the same case in prompt injection vs jailbreak.

Worth separating from this, because coverage regularly conflates them: GeminiJack, disclosed by Noma Labs, was a zero-click indirect prompt injection in Gemini Enterprise and Vertex AI Search, not the CLI. A poisoned document in Workspace caused Gemini Enterprise to retrieve it during a normal search and exfiltrate Gmail, Calendar and Docs content through a disguised image request. Same attack class, different product, different fix. If someone tells you GeminiJack means your CLI pipeline is exposed, they have not read either advisory.

Google ships a genuinely reasonable set of controls. They are also narrower than their names suggest, and Google says so in its own enterprise documentation, which is more than most vendors in this category do.

That last row deserves credit rather than criticism. Google wrote down the limit of its own control instead of leaving buyers to discover it, which is the standard we hold ourselves to further down this page. The practical reading for a US security team: these settings are excellent for stopping a well-meaning engineer from doing something expensive, and they are not the thing standing between a hijacked agent and your production systems.

One genuine strength is worth stating plainly. Gemini CLI runs locally while the model runs in Google's cloud, and under Gemini Code Assist Standard and Enterprise licensing, Google states that customer code, inputs and generated recommendations are not used to train shared models. If your blocker is training data rather than runtime behavior, that is a real answer and it is on paper.

On May 19, 2026 Google announced that Gemini CLI was being transitioned to Antigravity CLI, and on June 18, 2026 the cutoff took effect. This is the single most important fact for scoping the work, and it is missing from most security guidance still circulating.

The security consequence is a fork. If your developers are on Standard or Enterprise licenses, Gemini CLI is still live in your estate and still needs the version floor and the settings work above. If they were on Pro, Ultra or the free tier, they have already moved, and whatever review you did of Gemini CLI does not transfer, because Google states Antigravity CLI "shares the same agent harness as Antigravity 2.0," a different codebase from the one you assessed.

Antigravity's short public security history is worth reading before you sign off on the migration. Two findings are on the record.

Secure Mode bypass leading to remote code execution. Pillar Security reported it on January 7, 2026, Google fixed it on February 28, 2026 and awarded a bounty on March 26. The technique abused the Pattern parameter of the find_by_name tool: "By injecting the -X (exec-batch) flag through the Pattern parameter, an attacker can force fd to execute arbitrary binaries against workspace files." What makes it instructive is why the strictest available setting did not help. In the researchers' words, "Find_by_name is classified as a native tool, not a shell command. Native tool invocations execute before Secure Mode's restrictions are evaluated, so the security boundary never sees the call." That is the same structural error as CVE-2026-12537: the dangerous path did not pass through the checkpoint.

Persistent code execution from a malicious workspace. Mindgard published a finding it calls Forced Descent, in which markdown rules in a project's .agent directory instruct the agent to write a malicious mcp_config.json into the global Antigravity settings directory, producing code execution on every application launch that survives uninstalling and reinstalling. Report the honesty here in full: Mindgard reported it to Google on November 19, 2025, Google closed it on November 21 as "Won't Fix (Intended Behavior)," then reopened it on November 25 after Mindgard published. We have not found a published fixed version, so treat this as open and control it by not opening untrusted repositories in an agentic IDE, which is advice you should already be following after the Cursor findings.

Two other differences matter commercially rather than technically. Antigravity CLI is not open source, where Gemini CLI was, so third-party security review of the harness is no longer possible in the same way. And migration is a real reinstall rather than an upgrade, which means it is the natural moment to apply an allowlist and a sandbox policy from the start instead of retrofitting one.

Ordered by risk removed per hour spent. The first three are the ones that would have stopped published attacks.

1. Pin the version floor in CI first. Gemini CLI 0.39.1 or later, google-github-actions/run-gemini-cli 0.1.22 or later. Grep every workflow file for the action reference and for floating tags. A workflow pinned to a mutable major tag is not pinned.
2. Never run an agent with write-capable credentials against content an outsider can author. Issue bodies, pull request titles, issue comments and forked branches are all attacker-controlled input. If a triage or review workflow must read them, run it with a read-only token and no repository write scope, and require a separate human-approved job for anything that writes.
3. Assume the yolo approval mode plus untrusted input equals code execution. If automation genuinely needs unattended tool calls, pair it with a sandbox and a coreTools allowlist, and confirm on your actual version that the allowlist is enforced, since before 0.39.1 it was not.
4. Enforce policy from system overrides, not from the repository. The precedence order ends at the system overrides file, so put sandbox enforcement and the tool allowlist there where a workspace settings file cannot relax them.
5. Allowlist, do not blocklist. Google's own guidance is unambiguous on this and it is worth the extra week of tuning. Start from the four or five commands your workflows actually run.
6. Keep folder trust enabled and trust narrowly. Trust the specific project, not the parent directory, because trusting a parent trusts everything beneath it. Never open a repository you did not review in an agentic IDE.
7. Scope the secrets the agent's environment can see. CVE-2026-12537 was valuable because a CI runner's environment is full of credentials. Short-lived, narrowly scoped tokens turn host code execution from a breach into an incident.
8. Inventory which tier each team is on. After June 18, 2026 this determines whether you are securing Gemini CLI, Antigravity CLI, or both at once. Most estates we see are both.
9. Review MCP servers separately. Both tools load MCP configuration, and the Forced Descent finding turns global MCP config into a persistence mechanism. Allowlist servers and pin tool definitions. See MCP server security.
10. Log agent tool calls somewhere the developer machine and the CI runner cannot edit. If the host is compromised, its local logs are the first artifact an attacker rewrites. See audit trail.

Steps one and two are unglamorous and produce no visible improvement, which is exactly why they are still undone in most of the pipelines we look at.

We sell an agent policy layer, so read this table skeptically. It is written to be accurate rather than flattering, and the first three rows are a flat no.

Three flat no, one partly, three yes. If you are running a vendor evaluation, ask every vendor in this market for the same table and treat an all-green answer as a reason to look harder rather than a reason to shortlist. Our survey of who genuinely does what is in AI agent security companies.

The honest summary of Gemini CLI security: Google built better controls than most agent vendors, documented their limits more candidly than most agent vendors, patched a maximum-severity flaw quickly, and still shipped two separate defects where the dangerous path ran before the checkpoint that was supposed to see it. That is not a Google problem. It is what happens when a language model is given a shell, and it recurs identically in Claude agent security, Cursor and every other tool in coding agent security. The durable control is not a smarter filter in front of the model. It is a narrow, enforced boundary around what the agent may do once the model has already been convinced.