Gemini AI Agent Privilege Escalation Attack Path Revealed

A low-privilege AI agent in Google Gemini-based development automation has been identified as having an attack path that could lead to GitHub token exposure and manipulation of pull requests by enticing higher-privilege workflows. Pillar Security reported that it discovered an "agent-to-agent privilege escalation" attack path in GitHub workflows related to the Gemini CLI. The attack begins with prompt injection in public issues or pull requests, and if the AI agent accepts this as a normal task, commands inserted by the attacker could be executed. According to the research, the Gemini CLI repository has over 101,000 GitHub stars, and at least eight Google repositories have been found to exhibit the same vulnerable pattern. GitHub's security advisory classified the vulnerabilities in Gemini CLI and run-gemini-cli as "Critical" and assigned a CVSS score of 10.0. The affected versions are those below @google/gemini-cli 0.39.1 and 0.40.0-preview.2, and run-gemini-cli below 0.1.22. The research is related to the security of the development supply chain in the crypto industry, as AI code review or issue classification agents could lead to code tampering and contamination of deployment paths if they gain access to deployment tokens or cloud keys. A suggested defense is to separate AI agents that read external inputs from high-privilege execution environments.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.