Gemini CLI decoupled its sandbox from your host config directories entirely.

PR #29214, merged September 11 and in nightly v0.61.0-nightly.20260912, stops --sandbox runs mounting the host user's persistent configuration and credentials. It replaces host directory mounts with sanitized config files, standardizes on realpath resolution during path-sensitivity checks with a fallback for non-existent paths, validates resolved working directories against sensitive host locations before mounting, and restricts ephemeral directory permissions synchronously. Covers Docker, Podman, runsc, LXC and macOS sandbox-exec Seatbelt profiles. If you were running --sandbox and assuming your credentials weren't in there, they were.