The wrong kind of access.

Researchers at Pillar Security reported a vulnerability in Google’s Gemini CLI workflows that could allow a crafted GitHub issue to trigger remote code execution and enable escalation to a GCP project compromise. The exploit chain relied on an overly permissive tool allowlist, exposed Workload Identity Federation credentials, and broad service-account impersonation rights; Google responded by tightening tool restrictions, blocking credential file access, and limiting impersonation permissions.