Gemini CLI is adding another layer of human approval as AI coding agents gain greater access to software projects, targeting a security risk involving build files and untrusted instructions.
Google has tightened Gemini CLI's security controls so that changes to build configuration files require explicit user confirmation. The update is designed to reduce the risk of indirect prompt injection, where instructions hidden inside project files or other untrusted content could influence an AI coding agent into making dangerous changes.
AI coding agents are becoming increasingly capable of doing more than generating snippets. They can inspect entire repositories, modify files, execute commands and help developers complete multi-step engineering tasks.
That growing level of autonomy also creates a new security problem: the AI may encounter instructions that were not written by the developer but can still influence what it does.
Google's latest Gemini CLI update focuses on one particularly sensitive part of the development environment — build files.
Why Build Files Matter
Build files contain instructions that determine how software is compiled, packaged or executed. Depending on the project, they can influence development tools, dependencies, scripts and other parts of the software supply chain.
That makes them more sensitive than an ordinary source-code file. A seemingly small modification can change what happens when a developer builds or runs a project.
Gemini CLI's new protection therefore introduces an additional checkpoint before the agent is allowed to modify those files.
The Prompt-Injection Problem
Prompt injection occurs when an AI system encounters instructions embedded in content it is processing and treats those instructions as commands. In a coding environment, that content could come from project documentation, files, external data or other material that the developer did not intend to give the model authority over.
The danger becomes greater when an AI agent has permission to take actions rather than simply answer questions. If an agent can edit files and execute commands, a malicious instruction can potentially move from text into an actual change to the developer's environment.
Gemini CLI 0.61.0 specifically addresses an indirect prompt-injection path involving build-file modifications and untrusted flags, while also strengthening sandbox boundaries.
Human Approval Becomes the Security Layer
The important change is not that Gemini CLI can no longer work with build files. It can. Instead, the policy engine can require the user to approve a proposed modification when the target is identified as a build configuration file.
This puts a human checkpoint between the AI's decision and a potentially sensitive change. The approach fits a broader shift in AI coding tools toward permission systems, planning modes and controlled execution.
Google's own Gemini CLI documentation already describes a workflow in which proposed file changes are presented as a unified diff that users can review and either approve or reject.
AI Coding Agents Are Becoming More Powerful
Gemini CLI is part of a wider movement toward agentic software development. Instead of simply suggesting code, modern coding agents can inspect repositories, understand dependencies, make changes and run development commands.
That makes them considerably more useful for developers, but it also changes the security model. The question is no longer only whether AI-generated code is correct. Developers also have to consider what the agent is allowed to read, modify and execute.
Google's move shows how permission controls are becoming part of the architecture of AI development tools rather than an optional extra.
What Developers Should Watch
For developers using Gemini CLI, the update means some build-file operations may require an additional confirmation step. That can introduce a small amount of friction, but it also gives users an opportunity to inspect what the agent wants to change before the modification happens.
Developers should also pay attention to the source of information their coding agents consume. A repository can contain documentation, configuration files and scripts that are useful to the agent while simultaneously becoming potential attack surfaces.
As AI agents gain more access to computers and development environments, permission boundaries, sandboxing and human review are likely to become increasingly important parts of everyday software engineering.
The next stage of AI coding is not simply about giving agents more power. It is also about deciding exactly where that power must stop and when a human should be asked to take control.
Technology, AI and the ideas shaping what comes next.
