Project
Gemini CLI is Google's open-source command-line tool for using Gemini AI models, enabling coding assistance and agentic workflows in the terminal.
A dev.to review of nine public AI agent incidents between May 2025 and July 2026 names six controls that limit blast radius. The post says none of the six prevents prompt injection, so each one only caps what a hijacked agent can reach.
Reality
Gemini CLI skips a yolo value in settings.json and never turns on the sandbox for it, a dev.to read of the source found. Anyone who wants YOLO every session needs a shell alias and an explicit --sandbox.
Reality
AIR says Claude Code, Codex, GitHub Copilot and Gemini CLI all check out a pinned plugin commit without verifying they landed on it, so a trusted plugin can be swapped for attacker code during a background auto-update. Anthropic and OpenAI have patched.
Perspective Coverage
4 publishersReality
JetBrains posted a CZK 315 million net loss in 2025, its first on record, on revenue that grew 6.3% to $710 million. Figures published on dev.to put the strain in costs, so teams on its IDEs should watch how JetBrains prices the AI agent it now ships in all of them.
Reality
n8n has opened its MCP tools to agent hosts including Claude Code, Codex and Cursor, so their agents can build and edit workflows from inside the coding tool. The workflows still run in n8n, so each host a team connects is one more place that can change a live automation.
Reality
Google researchers' Dream-RSI cut Gemini calls on a Lasso solver task from 550 to 317 by rewriting a Python search policy, with every model frozen. Teams running scored code search can test it as a call-budget saving on their own tasks.
Reality
Air Security found four coding agents skipped checking plugin code against its pinned commit SHA, a gap one test plugin used to reach 26,000 agents. Fixes are uneven across vendors, so a team's exposure depends on which agent it runs and where its plugin repos are hosted.
Reality
The MIT-licensed dsh runtime bundles sessions, tool calls, permissioning and a local web UI, with model adapters as plugins covering Anthropic, OpenAI, Bedrock, Vertex and Azure. It is still a preview.
Reality
Anthropic's open SKILL.md format is read by roughly forty agent tools, among them Codex, Cursor, Copilot and Gemini CLI. Each installed skill costs about 100 tokens a session until a task matches its description and the full workflow loads.
Reality
Specific Labs scores coding agents on licensed production codebases. The best setup clears 38.8%. The analysis covers ten tasks at eight runs each, so every published score is a count of passing rollouts out of 80.
Perspective Coverage
3 publishersReality
GKE Agent Sandbox is generally available and publishes provisioning numbers a team can plan against. The scheduling and durability layers stacked on top of it rest on one public demo, and the deprecation argument lands there.
Reality
Plugin4Shell lets attacker code replace SHA-pinned plugins in Claude Code, Codex, Gemini CLI and Copilot through default auto-update, with no prompt. A pin only protects you if the agent checks fetched code against the hash, so agent plugins need the same review as any other dependency.
Reality
Claude Code started reading AGENTS.md on September 18, but only where no CLAUDE.md sits in the working directory or any parent above it. Monorepos need a stub file per package or a change to the instructionFiles setting.
Reality
Oren Yomtov of Accomplish found two ways out of the Codex sandbox, both silent and neither stopped by an approval prompt. OpenAI patched them within eight days, and other researchers have found the same design in rival agents.
Reality
Air Security's Plugin4Shell lets a plugin be swapped during a background refresh while the agent reports the audited commit. Anthropic and OpenAI have patched, Copilot has no fix, and Google is retiring Gemini CLI.
Reality
The repo advertised a token-cost dashboard that read agent session logs locally. According to a dev.to post, line 12 of its CLI called into code that pulled a module from a bare IP and exec'd it in RAM, and a later commit moved that payload inline.
Reality
Researchers at AIR found that four AI coding agents accepted a Git checkout they never verified, and because no marketplace can close the gap, the repair now travels through agent version numbers inside each enterprise.
Reality
Oren Yomtov of Accomplish AI found two escapes from the Codex sandbox. The worse one ran unsandboxed commands from read-only mode through a helper tool that Codex Desktop writes into the global config at install.
Reality
Anthropic shipped the AGENTS.md fallback in Claude Code 2.1.277 as a flag-gated built-in mod. Two machines on the same pinned version can load different project instructions. The same week's digest also logs a reverted deny-rule fix.
Perspective Coverage
4 publishersReality
The Unified Harness Protocol specifies how an application starts a task on an agent runtime, follows it, cancels it and collects the files, borrowing the shape of OpenAI's Responses API so existing streaming clients need no changes.
Reality
Leadership · September 3, 2026 · One report1 publisher