Gemini CLI patch blocks zero-click RCE in untrusted workspaces
luisfelipe-alt · ghdev · 2026-07-21
A Google Gemini CLI PR hardens a2a-server against zero-click RCE and environment poisoning in untrusted workspaces.
The patch changes startup and config loading so workspace .env files are ignored until trust is verified, and it isolates per-task environment state using AsyncLocalStorage plus a Proxy around process.env.
Key changes:
- defer environment loading until after workspace trust checks
- ignore workspace .env and .gemini/.env when the workspace is untrusted
- only load trusted home-directory env files in that case
- isolate task-level env and directory behavior to reduce cross-task leakage
More from coding & agent
- NVIDIA says Nemotron 3 Ultra hit 97.1% on agentic RTL chip-design tasks — NVIDIAAI · 2026-07-27
- Tokyo Agent Forge hackathon shipped production-ready AI agents in one day — DavidBennett__ · 2026-07-27
- Long-running agents will need immutable event logs, this thread argues — sebpaquet · 2026-07-27
- Agentic Data Science in Practice: Agents Write Code but Answer Wrong Questions — hugobowne · 2026-07-27
- A VS Code extension adds Markdown-style highlighting to Alchemy string templates — samgoodwin89 · 2026-07-27
- Claude’s Stripe MCP connector is being called unusable after repeated disconnects — evielync · 2026-07-27