What changed
Google’s stable Gemini CLI v0.60.0 release bundles a broad set of security-boundary changes. Extensions that want to modify environment variables now require explicit user consent, and the CLI sanitizes variables that can alter runtime behavior. Sandbox execution isolates Gemini settings and temporary directories more deliberately. Filesystem validation received multiple path, symlink and Windows short-filename hardening changes. The MCP OAuth client also implements RFC 9207 authorization-server issuer identification, giving it a stronger check that the authorization response came from the expected issuer.
Why it matters
Coding-agent security depends on more than the model’s visible tool permissions. Extensions can mutate process state, sandboxes can accidentally inherit host configuration, path aliases can cross workspace boundaries and OAuth redirects can become trust-confusion points. Gemini CLI 0.60 moves several of those controls into the client itself. The practical lesson for builders is that an agent harness should treat startup configuration, environment inheritance, path canonicalization and remote-tool authentication as first-class security boundaries rather than assuming the sandbox or approval prompt covers them.
Extensions need consent before changing the environment
The release adds explicit consent around extension-driven environment changes and sanitizes runtime-altering variables. That reduces the chance that installing or activating an extension silently changes how subprocesses, shells or other tooling execute.
Sandbox state is separated more aggressively from the host
Gemini CLI now isolates settings and temporary-directory behavior used inside sandboxed execution. A sandbox is more useful when configuration that affects the trusted host does not simply bleed into the untrusted runtime.
Path handling received a cross-platform hardening pass
The release includes fixes around workspace validation, symbolic links and Windows path forms including short filenames. These edge cases matter because security checks performed on one representation of a path can be bypassed when the operating system resolves another representation to the same file.
MCP OAuth now checks the authorization-server issuer
Gemini CLI implements RFC 9207 issuer identification for MCP OAuth. The issuer value lets the client bind an authorization response to the authorization server it expected, narrowing authorization-server mix-up and confused-endpoint risks.
The changes reinforce a broader coding-agent security pattern
Recent agent vulnerabilities have repeatedly appeared below the model layer—in Git subprocesses, credential injection, sandbox configuration and client policy. Gemini CLI 0.60 addresses several such surfaces at once, but it should still be treated as defense in depth rather than proof that every extension, MCP server or sandboxed command is safe.