Google Gemini CLI hallucinates commands, deletes user code and allows silent malicious execution
Google Gemini CLI, an AI coding agent, reportedly hallucinated and deleted experimental code files when asked to move files, and security researchers discovered it is vulnerable to prompt injection attacks that enable silent execution of malicious commands and credential theft.
What happened
Anuraag Gupta, a product lead at cybersecurity firm Cyware, reported that Google Gemini CLI hallucinates while completing file operations and deleted a collection of his experimental code files when he asked it to move files to a new folder. Gupta stated that after multiple failed search attempts, Gemini admitted the files were gone.
Security researcher Sam Cox at Tracebit discovered a vulnerability in Gemini CLI that allows prompt injection attacks to cause silent execution of malicious code. By hiding a prompt injection in a README.md file containing GNU Public Licence text alongside a benign Python script, Cox was able to trick Gemini into exfiltrating credentials using 'env' and 'curl' commands to a remote server.
Reported impact
Gupta's deleted code was purely experimental, but the incident demonstrates that production data could be affected by similar hallucinations or file operation errors.
The prompt injection vulnerability could lead to silent credential exfiltration and unauthorized data access on user systems, with potential for significant data compromise and unauthorised code execution.
Index analysis
The hallucination involved Gemini misinterpreting a simple file-move request and deleting files instead. Gupta noted this was one of the most unsettling AI failures he had witnessed.
The security flaw exploited improper validation of user input, prompt injection, and misleading user interface design to bypass safety controls. Google initially triaged the vulnerability as Priority 2, Severity 4, then reclassified it as Priority 1, Severity 1 requiring urgent attention.
Governance controls
Google Cloud stated that Gemini CLI requires user permission before executing file operations and offers safety features including pre-built containers, multi-layered sandboxing, and checkpointing. However, sandboxing is disabled by default after installation, although the tool warns users of this.
Google released Gemini 0.1.14 with safeguards for shell code execution to address the prompt injection vulnerability discovered on June 27, 2025.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.