Gemini CLI 0.61.0 asks before running a build it edited and keeps credentials out of its sandbox

Gemini CLI 0.61.0 appeared on GitHub on September 23, 2026. Its release notes are short, but two of the listed changes are security fixes. One targets prompt injection that travels through build files and command flags. The other tightens what the sandbox can see on the host.

Build files and outside content

The first fix applies in restricted workspace mode. The shell, edit, and write_file tools now check whether a command's flags or arguments came from outside content. The pull request names Google Docs, Buganizer, fetched web pages, and MCP server responses as examples. When they did, the agent asks for explicit confirmation.

The same change tracks build configuration files such as package.json, Makefile, pyproject.toml, and BUILD.bazel. If one of them was edited or created during the session, every later build or test command, such as npm run, make, or cargo, is shown to you for confirmation first.

What the sandbox no longer sees

The second fix covers the sandbox started with --sandbox, on Docker, Podman, runsc, LXC, or macOS Seatbelt.

• The sandbox refuses to start from a sensitive directory: the root of your home directory, the filesystem root, or ~/.gemini.
• Your home directory and ~/.gemini are no longer mounted into the container. The sandbox gets a cleaned copy of your settings without hooks, custom tool commands, or API keys.
• The macOS Seatbelt profiles now explicitly deny reads of credential files such as oauth_creds.json and .env, and deny writes to ~/.gemini.
• A sensitive path listed in SANDBOX_MOUNTS now stops the launch with FatalSandboxError. The same path in allowedPaths is dropped with a warning in the log.