My Agentic Trust Issues: From Prompt Injection to Supply-Chain Compromise on gemini-cli

Pillar Security discovered a CVSS 10 prompt-injection vulnerability in Google’s Gemini-powered issue-triage GitHub Actions workflow that enabled an attacker to exfiltrate workflow secrets from a public issue, steal GITHUB_TOKEN data persisted on disk, and pivot via workflow dispatch to obtain contents:write and push arbitrary code — demonstrated end-to-end against google-gemini/gemini-cli; Google patched the run-gemini-cli action and Gemini CLI and published mitigations and best-practice changes.