Prompt injection in GitHub repo cracked Google Cloud via Gemini CLI
A cybersecurity researcher just demonstrated exactly why AI coding tools with broad cloud permissions are worth watching closely.
What Happened
Dan Lisichkin of Pillar Security revealed this week how a prompt injection embedded in a GitHub repository was used to gain Editor-level access to an internal Google Cloud project. The attack path ran through a flaw in the CLI of Google Gemini CLI, the AI coding tool Google provides.
The specific setup code affected was the internal automation Google uses to automatically read and sort bug reports filed on its public GitHub page. By slipping a malicious prompt into a repository that code would process, the injection escalated into real access on a live Google Cloud project.
The Operator Angle
This is a textbook prompt injection attack, and the target was not a startup or a dev shop running loose permissions. It was Google’s own internal tooling. That matters because the same class of vulnerability applies anywhere an AI agent reads external content and then acts on cloud resources with elevated credentials.
If you’re running AI coding assistants or agents that have access to your cloud accounts, your CI/CD pipelines, or your repositories, the permission scope those tools operate under is a direct attack surface. Editor-level access is a serious grant. Most developers set it and forget it.
Status
Google has since remediated the flaw, according to Pillar Security. No details on the fix were shared in the disclosure.
The research is a useful reminder that prompt injection is not just a chatbot problem. Anywhere an LLM reads untrusted input and has the ability to take action, injection is a live risk worth scoping before you deploy.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
