Vulnerability / research

Gemini workflow research connects prompt injection to excessive cloud privileges

Reported

What happened

Pillar demonstrated a chain combining ineffective workflow tool restrictions, accessible credentials and overly broad cloud permissions. Its mirrored-lab test relaxed the system prompt to reliably trigger commands; the permissions could enable Editor-level access.

Parties and reporting

AI tools and systems: Gemini CLI, run-gemini-cli GitHub Action, Google Cloud Workload Identity Federation

Outcome

Google changed workflow configuration and narrowed the setup script’s IAM grant. Pillar reports fix verification on August 14; cleanup of existing customer IAM grants is unconfirmed.

Operating lesson

Test enforced tool restrictions and audit existing cloud grants; updating a setup script alone does not remove permissions already assigned.

Evidence and limits

June 29 dates public disclosure of the WIF permission component; the combined-chain report appeared August 18. Google identified its project as a dedicated triage sandbox. This is research, not evidence of customer compromise; the earlier April trust-model advisory covered different defects.

Sources