Google's Gemini CLI Workflow Hacked Through Malicious Prompt Injection

Cybersecurity researchers from Pillar Security have discovered a flaw in Google's Gemini CLI workflow that allowed them to gain Editor-level access to an internal Google Cloud project.

The attack began with hidden instructions embedded in a GitHub issue, which were processed by an AI agent triaging bug reports. The prompt injection led to the issuance of Workload Identity Federation credentials, one of which enabled impersonation of a more privileged account.

According to Dan Lisichkin, a cybersecurity researcher for Pillar Security, the flaw existed in Google Gemini CLI setup code used internally to automatically read and sort bug reports filed on its public GitHub page. A Pillar Security researcher was able to file a 'bug report' that included hidden instructions, resulting in a legitimate credentials file being issued via the Workload Identity Federation framework.

The compromised project was running in a dedicated internal sandbox, and Lisichkin noted that while this might be viewed as a single isolated incident, it illustrates how relatively trivial it is becoming to compromise a software supply chain in the AI coding era. An entire software supply chain could be compromised at machine speed through malicious prompt injections.