Gemini CLI patches build-file prompt injection hole

Google patched an indirect prompt injection hole in Gemini CLI's build process. Release v0.61.0-preview.0 includes PR #29250, which closes off an attack where the agent reads a repo's build configuration and treats the file's contents as instructions rather than data.

That distinction is the whole problem. An agent asked to run a build opens the build file to figure out what to do, the same way it would read a system prompt. If an attacker controls any line in that file, they control part of what the agent does next. A malicious dependency, a poisoned template, or a compromised contributor's commit could all plant text there.

Build files get treated as safe because they look like configuration, not like user-facing content. Nobody reviews a webpack config or a Makefile for injected natural-language commands the way they'd review a comment field or a chat message. That blind spot is what makes it useful to an attacker, and why it took a dedicated patch to close.

Google's release notes don't say how long the hole existed before the fix, or whether other build-adjacent files, like CI configs, lockfile scripts, or post-install hooks, get the same treatment. Anyone running a coding agent that executes builds automatically has an open question to chase down before assuming they're covered.

The fix is specific to Gemini CLI. Every other agent that shells out to npm run build or make and reads config along the way inherits the same exposure until its maintainers ship something similar.