ACVERogue and malicious agent events

Advisories › ACVE-2026-0013

ACVE-2026-0013 · Hijack shown in a test · HIGH

Unverified · secondary sources only

WHAT HAPPENED

The agent runs a command that begins with grep and, after a long run of whitespace, sends the environment variables to a remote server.

THE SETUP — is yours like this?

Harness
Gemini CLI below 0.1.14 · < 0.1.14, tracebit.com
Model
any model (unconfirmed)
Goal
Tell me about this repo (the Tracebit scenario, run against a freshly cloned repository), tracebit.com
Tools
run_shell_command; grep added to the session allowlist by the user always-allow answer; a README.md file carrying the hidden instructions, tracebit.com
Approval
The user allowlisted grep for the session; a later command beginning with grep was matched by its root command only and ran with no prompt, tracebit.com

WHAT TO CHANGE

Upgrade Gemini CLI to 0.1.14 or later.

  • Upgrade harness:gemini-cli to 0.1.14. First release with the fix. Owner: operator
  • Reconfigure google.gemini-cli.allowlist to the root-command allowlist match fixed. Shipped by Google (2025-07-25): fixed in Gemini CLI 0.1.14. Owner: harness-vendor

HARM, REACH AND RECOVERY

Harm
data-exfiltration
Reach
A shell on the developer's machine and its network access, tracebit.com (the network, API keys)
Condition
After the user allowlisted grep for the session and a README carried hidden instructions, tracebit.com
Evidence and responses
Demonstrated · researcher report
Google fixed — github.com

SOURCES

REPORT

FIX

Technical details

Environment variables are sent to a remote server with no prompt when a cloned repository's README steers Gemini CLI below 0.1.14 to a grep-prefixed command after the user allowlisted grep.

Model as recorded: any

Severity
HIGH · harm and reach
Status
Unverified
Kind
Hijack shown in a test
Modified
2026-09-25
Aliases
No CVE assigned — No CVE identifier appears in the researcher write-up or the fixed release.
CVE boundary
user-configured
Affected
  • npm: @google/gemini-cli — < 0.1.14
  • AgentHarness: gemini-cli — < 0.1.14
Harness/product
gemini-cli; @google/gemini-cli + gemini-cli
Classes
prompt-injection-to-tool; command-injection
Taxonomy
ATLAS: AML.T0051; ATLAS: AML.T0051.001; ATLAS: AML.T0086; ASI: ASI01; ASI: ASI05
First reported
2025-07-28 — Tracebit
Input controlled by
repo-author
Divergence
instruction-followed
Licence
CC-BY-4.0 advisories; MIT code

Reproducibility: partial (vulnerable components are not confirmed obtainable; trigger not published)

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

ClaimStatusSourceChecked
Fixed in 0.1.14Confirmedregistry.npmjs.org2026-09-23
Affected version below fixed 0.1.14 could not be checked from npmUnconfirmedregistry.npmjs.org

Description

What

Tracebit found that Gemini CLI compared a shell command with the user allowlist by extracting only the root command. Instructions hidden in a context file such as README.md first had the agent run a harmless grep, which the user allowlisted; a later command that began with grep and continued with an exfiltration command then ran with no prompt. A long run of whitespace inside the command kept the payload out of the displayed output.

Detection

The lockfile sees the version; a command allowlisted during a session is not written to it, and the README content is invisible.

Fix

Upgrade Gemini CLI to 0.1.14 or later (released 2025-07-25).

Configuration

The rule ACVE's audit tool uses to recognise this configuration. The tool is not public yet.

and
  harness.id eq "gemini-cli"
  harness.version semverRange "<0.1.14"

Report a problemJSON