Prompt injection in a README plus weak allow-list matching lets Gemini CLI silently run attacker commands (2025)
Researchers hid a prompt injection inside a README.md (in the text of a software license) so that Gemini CLI, asked only to inspect a codebase, would request shell commands.
What happened
- Users can allow-list a command such as grep for the session; Gemini CLI matched commands against that list too loosely, so "grep" followed by a second, malicious command was treated as allowed and ran without asking.Code Execution Through Deception: Gemini AI CLI Hijack
- The demonstrated command silently sent the user's environment variables, which may contain secrets, to an attacker; Google rated it P1/S1 and fixed it in v0.1.14 on July 25, 2025.Code Execution Through Deception: Gemini AI CLI Hijack
The failure pattern
Watch the pattern: Indirect prompt injection changes agent behavior
Safeguards that address it
CollectSEA's engineering analysis of what would have prevented or contained this failure.
- Match allow-listed commands exactlyParse the full command, including chained and piped commands, before treating it as pre-approved.
- Show the user exactly what will runDisplay the complete command text for any execution request and never hide output that an agent produced from untrusted content.
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
- ASI01 Agent Goal Hijack
- ASI02 Tool Misuse and Exploitation
- ASI03 Identity and Privilege Abuse
- ASI06 Memory and Context Poisoning
- ASI10 Rogue Agents
- LLM01 Prompt Injection
- LLM02 Sensitive Information Disclosure
- LLM03 Excessive Agency
- LLM10 Improper Output Handling
- AC-4 Information Flow Enforcement
- AC-6 Least Privilege
- SI-10 Information Input Validation
- MAP 5.1 Estimate impacts from past uses and public incident reports
- Goal 3 Reducing entire classes of vulnerability
- CWE-1427 Improper Neutralization of Input Used for LLM Prompting
- CWE-250 Execution with Unnecessary Privileges
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
Prompt injection makes GitHub Copilot turn off its own confirmations and run commands (CVE-2025-53773)
Instructions planted in content the agent reads could make GitHub Copilot write "chat.tools.autoApprove": true into the project's .vscode/settings.json, which turns off all user confirmations.
Hidden instructions in a support ticket make an MCP-connected assistant expose private SQL tables (Supabase MCP, 2025)
General Analysis showed that hidden instructions in a customer support ticket could make a developer's MCP-connected assistant query a private table of integration tokens.
EchoLeak: zero-click prompt injection lets a crafted email exfiltrate Microsoft 365 Copilot data (2025)
EchoLeak (CVE-2025-32711, CVSS 9.3) is a zero-click vulnerability in Microsoft 365 Copilot in which a crafted email could trigger indirect prompt injection.
Prompt injection in a public GitHub issue makes an MCP-connected agent leak private repository data (2025)
Invariant Labs showed that a malicious instruction placed in an issue on a public repository could be read by an agent connected through the GitHub MCP server.
Software component issue could allow unintended commands to run
The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users…
Software component issue could allow unintended commands to run
The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,…