No Prompt Required - Pre Task RCE in Google Gemini CLI

The talk looks at AI agent security from a point before the prompt. The speaker argues that agents read project configuration, environment files, and startup parameters before the model handles any task. In headless CI runs no person is present to approve actions, and the workspace is treated as trusted, so the decisions made at load time carry the most weight. Prompt injection and guardrails do not cover this path.

The main case is Google's Gemini CLI, run as a GitHub action to review pull requests. The speaker walked through its three defenses: a container sandbox, environment sanitization that strips secrets, and a tool allow-list. Each of these runs after a project-level environment file has already been loaded in trusted mode. A proxy setting for the sandbox was then passed to a shell with shell enabled, which allowed command injection on the host. A demonstration showed a fork pull request reaching code execution on the runner host. Google rated the issue CVSS 10.0, patched it, and changed how it handles workspace trust. The speaker also cited a similar pre-trust configuration issue in Claude Code and a changed trust prompt in OpenAI Codex.

The closing guidance is a simple audit method for any agent. First, list every input the system accepts before work starts, including config files, startup flags, and protocol handshakes. Second, record what authority each input carries. Third, check whether that authority can reach command execution or change policy. If it can, the speaker says defenses applied at prompt time will not help.