Gemini CLI flaw reached a Google Cloud editor

Google’s Gemini CLI, a project with more than 100,000 GitHub stars, sat inside a workflow where an untrusted GitHub issue could reach Editor-level access to an internal Google Cloud sandbox, according to a vulnerability disclosed August 28. Pillar Security’s disclosure says the affected setup was remediated by Google; DevOps.com’s report confirms the compromised project was a dedicated sandbox. Builders using hard-deny controls for coding-agent auto mode should treat issue and pull-request text as hostile input and give the agent a narrower cloud identity than its tool surface.