Researchers at Pillar Security disclosed a prompt‑injection flaw in the Google Gemini command‑line interface (CLI) that allowed a crafted bug‑report entry to trigger the issuance of a Workload Identity Federation (WIF) credentials file. The injected prompt let the researcher extract that file, and one of the extracted tokens could be used to impersonate a higher‑privilege account, granting Editor‑level control over an internal Google Cloud project. Google has since patched the CLI code that processes GitHub bug reports.
What the Vulnerability Was
The Gemini CLI includes setup logic that automatically reads and sorts bug reports posted on Google’s public GitHub repository. Pillar Security submitted a bug report containing hidden instructions. When the AI agent that triages these reports executed the report, the hidden prompt caused the CLI to request a credentials file via the WIF framework. The credentials were written to a location the researcher could access. Most of the tokens were low‑privilege, but one token allowed the researcher to assume a more powerful identity, resulting in Editor access to a sandboxed internal project.
Why It Impacts AI‑Coding and Cloud Workflows
AI‑coding assistants increasingly rely on external data sources—code repositories, issue trackers, documentation pages—to generate or modify code. A prompt injection that reaches the AI’s execution path can turn a benign data‑pull operation into a credential‑exfiltration vector. In this case, the injection originated from a public GitHub issue, showing that any web‑accessible artifact that an AI tool consumes is a potential attack surface.
- Supply‑chain exposure: The attack chain started with a public bug‑report entry, not with direct network compromise.
- Privilege escalation via WIF: The injected prompt leveraged the existing WIF credential‑issuance flow, which is intended for legitimate workload identity federation.
- Editor‑level breach: The final token granted full control over an internal project, demonstrating that low‑level credential leakage can cascade into high‑impact compromise.
Operational and Security Takeaways
Practitioners using AI‑coding tools should treat the data ingestion paths of those tools as part of the trusted‑code base. Specific considerations include:
- Audit the sources that AI agents read (e.g., public issue trackers, documentation sites) and restrict them to vetted locations.
- Monitor WIF token issuance for unexpected request patterns, especially those originating from automated tooling.
- Implement short‑lived, least‑privilege tokens for AI‑driven workflows; avoid granting Editor‑level scopes to services that do not require them.
- Integrate prompt‑validation steps or sandboxed execution environments for AI agents that process external content.
Because the vulnerability was discovered in open‑source tooling that Google uses internally, the incident also highlights the need for continuous security review of third‑party or community‑maintained components that feed into production pipelines.
Related CloudNinjas coverage: security.
What This Means For Practitioners
AI‑coding pipelines are now a concrete entry point for supply‑chain attacks. Teams should inventory every external artifact an AI tool consumes, enforce strict provenance checks, and treat credential‑issuance mechanisms like WIF as high‑value targets that require additional logging and anomaly detection. Until the ecosystem matures, expect to allocate time for manual verification of AI‑generated code and for periodic reviews of the AI tool’s data‑source whitelist.
