Gemini CLI ships an external-context processor to stop indirect prompt injection through build files

GitHub·high signalXBlueskyLinkedInCopy link

PR #29250, merged 2026-09-11 across 19 files and released in nightly `v0.61.0-nightly.20260912`, adds three defenses. A processor scans conversation history for `<untrusted_context>` blocks and flags command parameters that originated in Google Docs, web fetches, or MCP servers; a tracker watches `package.json`, `Makefile`, `pyproject.toml`, and `BUILD.bazel` so that any later build command requires confirmation; and confirmation dialogs now name the specific parameters and recent modifications. The same nightly carries #29214, which hardens filesystem boundaries and isolates runtime state in the sandbox.