Gemini CLI patches a prompt-injection hole in build files and flags
A merged fix stops untrusted files from smuggling commands into your next npm run or make — plus a Claude Code patch that unbreaks unattended runs.
Copy markdown
The hole: a poisoned build file runs on your next build
Gemini CLI PR #29250, merged Sept 11, closes an indirect prompt-injection path: an attacker who can edit package.json, Makefile, pyproject.toml, or BUILD.bazel — or slip untrusted flags in through a web fetch or a linked doc — could get shell commands run the moment you kick off a routine build or test, with no approval prompt firing first.
The fix: build-file edits now force a confirmation
The patch tracks edits to build files during a session and makes any later npm run, make, cargo, or blaze require explicit confirmation; it also flags shell parameters pulled from untrusted context and drops the 'always allow' shortcut for them. It's in the latest nightly (v0.61) — if you point agents at untrusted repos, update before your next pull.
Elsewhere: Claude Code 2.1.270 stops the read-only git nag
Anthropic's Claude Code 2.1.270 fixes a regression where read-only git commands started re-prompting for permission in long-running sessions — the exact paper-cut that stalls unattended and automated runs. Patch-only; upgrade and move on.