Gemini CLI patch blocks zero-click RCE in untrusted workspaces
luisfelipe-alt · ghdev · 2026-07-21
A Google Gemini CLI PR hardens a2a-server against zero-click RCE and environment poisoning in untrusted workspaces.
The patch changes startup and config loading so workspace .env files are ignored until trust is verified, and it isolates per-task environment state using AsyncLocalStorage plus a Proxy around process.env.
Key changes:
- defer environment loading until after workspace trust checks
- ignore workspace .env and .gemini/.env when the workspace is untrusted
- only load trusted home-directory env files in that case
- isolate task-level env and directory behavior to reduce cross-task leakage
More from coding & agent
- GPT-6 Astra beats Factorio with enemies in 44 in-game hours at ~$4,500 API cost — liminal_bardo · 2026-09-11
- Investment Analyst Asks How to Build a Claude-Based Diligence Agent Stack — Careless_Tie2286 · 2026-09-11
- Treating agents like 50 First Dates: a 3-layer context system so every conversation doesn't start from zero — evielync · 2026-09-11
- Running the Firefox MCP on Android via Termux, ngrok, and mcp-proxy — Nervous-Strain7544 · 2026-09-11
- SmolVM open-sources persistent computer infrastructure for agents that outlive chat sessions — aniketmaurya · 2026-09-11
- ARRM targets silent economic regressions in AI agents that functional tests miss — Beautiful_Belt_601 · 2026-09-11