Gemini CLI prompt injection shows the new AI tool attack surface

At a glance

What this is: Cyera’s research shows that Gemini CLI had command injection and prompt injection flaws that could turn AI tool interactions into arbitrary command execution with the process’s privileges.

Why it matters: IAM, PAM, and NHI teams need to treat AI developer tools as execution boundaries, because prompt handling and shell invocation can collapse governance assumptions about who or what is really acting.

Context

Gemini CLI is a command-line AI tool, so the security problem is not just model output quality but the trust boundary between natural language, local files, and shell execution. When an AI tool can translate input into process-level action, identity governance has to account for how commands, tokens, and configuration are consumed inside the same runtime.

Cyera says the two findings in Gemini CLI were exploitable in production and could expose development environments, credentials, and model data. That makes the article relevant to NHI governance because the risk sits in machine-executed workflows that inherit the privileges of the CLI process, not in a human login flow.

The article also shows a second-order risk for security teams: AI-augmented research can speed up vulnerability discovery, but the same toolchain can create a broader attack surface when command validation is incomplete or shell construction is unsafe.

Key questions

Q: What breaks when an AI CLI can turn prompts into shell execution?

A: The boundary between model interaction and system action breaks first. A prompt no longer just influences output, because the tool can translate that output into a privileged command path. That means conventional review cycles, which assume a human or stable workflow sits between intent and execution, no longer describe the real risk.

Q: Why do AI assistants create more credential risk than traditional developer tools?

A: They often aggregate access to many external services in one workflow, then persist those credentials in predictable local files or sync them into shared environments. That concentration increases blast radius. A single compromise can expose code repositories, chat, cloud projects, and databases instead of just one application boundary.

Q: How can security teams tell whether an AI tool validation filter is too weak?

A: Look for filters that block only one command syntax while leaving equivalent forms open. If one substitution style is rejected but another can produce the same shell effect, the control is cosmetic rather than effective. Validation should be evaluated against the full command grammar, not a single string match.

Q: When should organisations isolate AI command-line tools from production credentials?

A: They should isolate them whenever the tool can read local files, invoke shells, or process untrusted prompts. Those capabilities create a direct path from natural language input to privileged execution, so the safe default is a constrained runtime with no broad credential reach.

Technical breakdown

Command injection in CLI-driven AI workflows

Command-line AI tools often bridge model output, local file handling, and shell execution. If user-controlled input reaches a shell without safe argument handling, metacharacters can turn a benign request into arbitrary command execution. In Gemini CLI, Cyera described a path where VS Code extension installation logic interpolated a file path into a shell command, which is enough to convert an installation helper into an execution sink. The technical issue is not the model itself, but the unsafe joining of input and process invocation in the same trust boundary.

Practical implication: treat any AI CLI path that constructs shell commands as an execution surface, not a convenience wrapper.

Prompt injection becomes system compromise when validation is incomplete

Prompt injection is usually discussed as a model-influence problem, but that framing is too narrow for tools that can act on the output. Cyera reported that Gemini CLI blocked one form of command substitution but failed to block backtick substitution, leaving a bypass in the command validation logic. That matters because partial filters create a false sense of safety: the model can still be steered into producing a payload that the surrounding tool executes. The control failure is therefore not only prompt handling, but the assumption that a small pattern block meaningfully constrains execution.

Practical implication: validate the full command grammar, not just one syntax variant, wherever AI output can reach a shell.

Why AI development tools widen the attack surface

AI development tools sit at the junction of credentials, source code, deployment settings, and model artifacts. Once an attacker can influence execution, the impact extends beyond the CLI process to the developer workstation or build environment that contains reusable secrets and privileged configuration. This is why prompt injection in a terminal tool is more dangerous than a misleading chat response. The architecture turns natural language into an input channel for privileged tooling, which means the protection model must assume that model-facing interfaces can be operationally active, not merely informational.

Practical implication: segment AI developer tooling from sensitive credentials, source trees, and deployment paths wherever possible.

Threat narrative

Attacker objective: The attacker seeks to turn AI-assisted development tooling into a privilege-bearing execution channel for code, secrets, and configuration abuse.

1. Entry occurred through malicious filesystem content or crafted prompts that reached Gemini CLI as trusted input.
2. Credential or command abuse followed when the tool turned that input into shell execution with the CLI process’s privileges.
3. Impact was arbitrary command execution with access to development environments, credentials, and model data.

Breaches seen in the wild

• EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.
• ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI CLI tools create an execution boundary, not just an interface boundary: When a command-line assistant can read local state and launch shell commands, the governance question changes from output trust to execution trust. Cyera’s findings in Gemini CLI show that the dangerous asset is the runtime bridge between prompt and process, because that bridge inherits process privileges. Practitioners should treat AI developer tools as privileged execution surfaces that require PAM-like discipline.

Prompt injection is an identity problem when the tool can act on it: The traditional assumption is that a prompt only influences text generation, but Gemini CLI shows that natural language can become an instruction path into system execution. That breaks the boundary between conversational input and authorised action. The implication is that identity governance for AI tools has to distinguish between model response and tool authority, because they are not the same thing.

Command validation cannot rely on partial pattern blocking: Cyera’s report illustrates a classic control gap where one substitution form was blocked and an equivalent form was left open. That is a weak enforcement model for any tool that can execute shell commands on behalf of a user. The right lesson for the field is that AI tooling inherits the same secure-by-construction requirement as any other privileged automation layer.

Developer tooling is becoming part of the NHI attack surface: Gemini CLI sits in the same practical risk domain as service accounts and automation agents because it can access credentials, configuration, and local project state. The control conversation therefore belongs alongside NHI governance, not only application security. Teams should classify AI command-line tools as workloads with privileged reach and govern them accordingly.

LLM-augmented research changes the speed of discovery, but not the governance burden: Cyera’s workflow reduced triage time dramatically, which shows how quickly security teams can surface real flaws when they combine static analysis with model-assisted validation. That efficiency does not reduce the need for secure execution boundaries; it increases the number of places where unsafe tool integration can be found. The practitioner takeaway is that faster discovery must be matched with tighter runtime controls.

What this signals

Identity governance for AI tools has to move to the issuance point: If a command-line assistant can convert prompt content into shell action, the meaningful control is no longer periodic review after access exists. The important question becomes which execution rights the tool receives at launch, what files it can touch, and whether those rights are bounded to the task rather than the host.

AI-assisted research will find flaws faster, but it also raises the bar for runtime containment: The same model-assisted workflow that reduces analysis time can uncover execution paths ordinary code review misses. That makes secure shell invocation, process isolation, and least-privilege runtime design part of the AI development toolchain, not optional hardening around it.

For practitioners

• Treat AI command-line tools as privileged execution surfaces Review any CLI-based AI workflow that can touch local files, shells, or deployment paths and subject it to the same oversight you would apply to other high-trust automation.
• Eliminate shell interpolation in AI tool handlers Refactor command construction so user-controlled paths and arguments are passed as discrete parameters rather than concatenated strings, especially in installation and plugin flows.
• Test command filters against equivalent syntax variants Validate backticks, subshell forms, escaping edge cases, and mixed quoting so a single blocked pattern does not leave a parallel execution path open.
• Separate AI tooling from reusable secrets and source assets Run AI developer tools in constrained environments that do not share broad filesystem access with credentials, build artifacts, or deployment configuration.

Key takeaways

• Gemini CLI showed that AI developer tools can collapse the boundary between prompt input and privileged command execution when shell handling is unsafe.
• The exploitable patterns were not theoretical edge cases, because Cyera reported production-relevant command injection and prompt injection paths that Google fixed.
• Teams should govern AI command-line tools as execution surfaces, then restrict shell reach, credential exposure, and filesystem access before the next tool joins the workflow.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Command injection: Command injection occurs when attacker-controlled data is inserted into a shell command and changes what the process executes. In AI tooling, that often happens through wrappers, plugins, or installation flows that turn paths or prompts into shell strings. The impact is privilege abuse through the process’s inherited authority.
• AI Command-Line Interface Abuse: AI Command-Line Interface Abuse is the misuse of command-line tools by or through AI systems to run unauthorized actions, exfiltrate data, or change system state. It includes prompt-driven shell execution, unsafe automation, and hidden command chaining. In security terms, it is a control failure where AI output becomes executable authority without sufficient validation, authorization, or monitoring.
• Execution boundary: The point at which an authorised task turns into a real system change, such as writing data, deleting records, spending money, or invoking a downstream tool. In AI governance, controlling the execution boundary matters more than simply approving access, because harm occurs when actions are allowed to complete unchecked.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.