Gemini CLI RCE shows how agentic workflows expand supply-chain risk

At a glance

What this is: Novee says a CVSS 10.0 Gemini CLI flaw allowed external attackers to execute commands on the host through trusted workspace content in CI/CD environments.

Why it matters: For IAM, PAM, and NHI teams, the risk is that agent tooling can inherit more execution trust than its identity controls were designed to govern, widening supply-chain blast radius.

By the numbers:

• A CVSS 10.0 RCE vulnerability in Google Gemini CLI allowed external attackers to execute commands on host systems, turning CI/CD pipelines into supply-chain attack paths.
• 0.39.1 and 0.40.0-preview.3

👉 Read Novee's analysis of the Gemini CLI CVSS 10.0 supply-chain RCE

Context

Gemini CLI supply-chain risk emerges when an AI tool is allowed to trust workspace content inside an unattended pipeline. In this article, the primary issue is not model behaviour but the control boundary between repository content, execution privilege, and agent configuration in CI/CD.

That matters to identity programmes because the agent, its action, and the runner hosting it all carry access that must be governed. When a non-human identity can execute before review or sandboxing, conventional approval and least-privilege assumptions no longer hold in the way teams expect.

Key questions

Q: What breaks when AI agents are allowed to act inside privileged CI/CD workflows?

A: What breaks is the assumption that repository inputs are still untrusted once a workflow starts running. If branch names, filenames, or pull request content can reach privileged shell steps, an AI-driven attacker can turn normal collaboration paths into code execution and publishing paths. That converts workflow automation into a control-plane exposure.

Q: Why do AI chat tools create risk for identity and access teams?

A: They create risk because users may rely on plausible but unverified output when making identity, access, or security decisions. That can lead to bad approvals, weak guidance, or sensitive data disclosure. The control problem is trust discipline, not just model quality.

Q: How do security teams know if an agentic pipeline is actually safe?

A: Look for evidence that untrusted input cannot reach execution without explicit validation. If repository content can still define commands, workspace configuration, or secret access in headless mode, the pipeline is not safe. A safe design separates content ingestion from execution and limits what the runner can touch.

Q: Who is accountable when an AI workflow executes attacker-controlled content on a host system?

A: Accountability sits with the teams that own the pipeline, the runner, and the secrets it can reach. This is a governance failure, not just a vulnerability disclosure. The relevant frameworks are NIST-CSF, NIST-800-53, and identity controls that define who or what can authorise execution.

Technical breakdown

How trusted workspace loading becomes code execution

The flaw sits in the trust decision made by Gemini CLI in headless mode. When the tool runs in a CI/CD job, it automatically trusts the current workspace folder and loads agent configuration from it without review. If an attacker can influence repository content, for example through a pull request, they can plant configuration that is treated as trusted input. That turns ordinary workspace parsing into a code execution path because the malicious content is acted on before the agent’s sandbox is initialized.

Practical implication: treat workspace trust in agentic pipelines as an access-control decision, not a convenience setting.

Why host-level execution matters more than prompt injection

This issue did not depend on manipulating a model into unsafe reasoning. Instead, it exploited the infrastructure layer around the model, specifically the host process that runs the agent and the shell or file-system access it inherits. That distinction matters because it bypasses many AI safety controls entirely. If the agent can execute on the host, the attacker is no longer trying to influence output. They are trying to reach secrets, credentials, source code, and deployment paths that the runner can touch.

Practical implication: isolate agent runners so host execution cannot expose reusable credentials or downstream deployment access.

Agentic workflows create a new supply-chain trust boundary

AI coding agents now sit inside software delivery pipelines with the privileges of trusted contributors. That means their attack surface includes prompts, repository files, configuration, secrets, shells, CI jobs, and production integrations. Traditional scanners see code or packages in isolation, but they do not model how an untrusted workspace item becomes an action with production impact. In supply-chain terms, the agent is not just a tool. It is a trusted execution participant whose identity and privilege must be constrained end to end.

Practical implication: define explicit trust boundaries for non-human identities that can read and act on pipeline content.

Threat narrative

Attacker objective: The attacker wants host execution inside the pipeline so they can steal reusable secrets and pivot into the software supply chain.

1. Entry occurs when an external attacker can influence repository workspace content in a CI/CD job, such as through a pull request or other untrusted input path.
2. Escalation happens when Gemini CLI in headless mode treats that workspace as trusted configuration and executes attacker-controlled content on the host before sandboxing starts.
3. Impact is host-level command execution that can expose secrets, credentials, source code, and downstream deployment paths from the runner.

Breaches seen in the wild

• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic pipeline trust is becoming a governance problem, not just a tooling problem. The vulnerability shows that a non-human identity can inherit more practical power from its runtime context than from any formal policy on paper. In CI/CD, the relevant control question is not whether the agent is allowed to act in general, but whether untrusted workspace content can become executable before the system validates it. That is a classic identity-and-execution boundary failure, and it belongs in PAM, NHI, and pipeline governance reviews.

Workspace trust collapse is the named failure mode this breach exposes. The control assumption that a checked-out repository can be treated as trusted input breaks down when an agent automatically loads configuration from that workspace. The breach worked because the pipeline let content become authority without a verification step. In practical terms, this is where least privilege fails for agentic systems: the agent is trusted to run, but the workspace is also trusted to define what it runs.

AI security controls that stop at the model layer miss the real risk. Prompt injection, jailbreaks, and output filters matter, but they do not address host execution before the model has meaningfully decided anything. The more important control plane is the one that governs shells, runners, credentials, and repo-triggered automation. The right response is to treat agent execution as a supply-chain identity problem and align controls with NIST-CSF, NIST-800-53, and OWASP-NHI principles.

Agent identity needs lifecycle controls, not just launch-time approval. Once an AI tool is embedded in delivery pipelines, its permissions can become persistent across builds, branches, and environments unless teams actively constrain them. That creates a non-human identity lifecycle problem with the same failure pattern seen in over-privileged service accounts: access outlives the context that justified it. Practitioners should treat every agentic workflow as a candidate for entitlement scoping, runtime isolation, and revocation checkpoints.

AI supply-chain risk is now converging with classic NHI governance gaps. The interesting part of this case is that the attacker did not need a model exploit to reach high-value assets. They needed an execution surface that had been granted too much trust. That is exactly why NHI governance is becoming central to AI security. Where agents can touch code, secrets, and deployment paths, identity controls become the difference between controlled automation and systemic exposure.

From our research:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to The State of Secrets Sprawl 2026.
• From our research: 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to The State of Secrets Sprawl 2026.
• Forward this into workflow design by reviewing Top 10 NHI Issues alongside agent execution paths and secret exposure points.

What this signals

Workspace trust collapse: this incident shows how quickly a repository becomes a control plane when agentic tooling is allowed to treat files as configuration. For practitioners, the programme implication is clear. If untrusted content can reach execution before validation, then sandboxing is too late and identity controls have been applied too far downstream. Align pipeline design with OWASP Agentic AI Top 10 and internal NHI governance reviews.

The next phase of risk is not simply more AI usage. It is more AI systems inheriting shell access, secrets reach, and deployment authority inside build and release pipelines. That means IAM and PAM teams need to track agent identities the way they track high-risk service accounts, with scoped permissions, short-lived access, and revocation paths that are actually tested.

A practical marker of maturity is whether teams can prove that a malicious repository change cannot become an executed command without an explicit decision point. If they cannot produce that evidence, the pipeline still depends on implicit trust rather than governed access. That gap belongs on the same risk register as over-privileged NHI, because the blast radius is identical even if the root cause is different.

For practitioners

• Restrict workspace trust at the runner boundary Disable automatic trust for repository content in headless agent runs and require explicit validation before configuration is loaded from a workspace. Separate untrusted pull request contexts from execution contexts so content cannot become instructions without review.
• Isolate agent runners from reusable credentials Run AI-assisted CI jobs in tightly scoped environments with short-lived tokens, no standing cloud access, and no access to secrets that are not needed for the specific task. Treat the runner as exposed until proven otherwise.
• Map agent privileges as non-human identities Inventory AI coding agents, GitHub Actions, and other automation that can read workspaces or invoke shells, then document the exact identities, secrets, and deployment permissions each one inherits. Remove broad contributor-style access where the workflow only needs read-only or task-specific rights.
• Add pre-execution validation for agent configuration Scan repository-managed agent configuration files, action inputs, and workspace artifacts before they reach execution. Pair content validation with allowlists for commands, files, and tool calls so attacker-controlled configuration cannot silently expand the agent’s authority.
• Test pipeline abuse paths with adversarial validation Red-team the full path from untrusted content to host execution, including pull request content, action configuration, and credential reach. Validate whether a malicious change can trigger command execution before sandboxing, then close the exact path rather than relying on generic hardening.

Key takeaways

• This vulnerability shows that agentic workflows can turn trusted repository content into host execution before AI safety controls even start.
• The evidence points to supply-chain exposure, not just a model issue, with host access creating a path to secrets, credentials, and downstream systems.
• The control that matters most is boundary enforcement between untrusted workspace input and executable authority, backed by NHI-style privilege scoping.

Key terms

• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• Workspace Trust: A trust control in code editors that separates passive file viewing from active execution of project-defined tasks. When disabled or bypassed, the editor can run repository instructions in the user’s context, which turns source control content into an execution path.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Supply chain attack path: A supply chain attack path is any route by which a trusted external tool, dependency or partner becomes the mechanism for compromise. It matters because attackers often abuse legitimate integrations instead of exploiting the core system directly, which makes detection and containment harder.

What's in the full analysis

Novee's full article covers the operational detail this post intentionally leaves for the source:

• Version-specific patch guidance for affected Gemini CLI and GitHub Action releases.
• The exact trust-path weakness that let workspace content become configuration in headless runs.
• The broader supply-chain attack patterns the research team used to contextualise the flaw.
• Why continuous adversarial validation is being positioned as a way to test live pipelines.

👉 Novee's full post covers the attack chain, affected versions, and pipeline validation implications.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle controls. It is designed for practitioners who need to govern non-human access in real operational environments.