Gemini Firewall

The surface

Gemini on the endpoint

Google's agent stack spans the terminal, the IDE, the browser, and Workspace — each with its own execution power.

CLI agent

Gemini CLI

Open-source terminal agent with run_shell_command and file write access. Config in ~/.gemini/settings.json, project context from GEMINI.md, and a --yolo mode that skips approvals.

IDE agent

Gemini Code Assist & Antigravity

IDE plugin across VS Code and JetBrains, plus an agent-first IDE where agents run commands automatically.

Browser agent

Gemini in Chrome — Auto Browse

Agentic browsing folded into Chrome and the Gemini app: navigates, books, and emails on the user's behalf.

Workspace + cloud

Workspace agents & Jules

Agents inside Gmail, Docs, Sheets, and Drive that create, edit, and re-permission files; Jules autonomously turns GitHub issues into PRs from cloud VMs.

Where the risk lives

Shell access plus injectable context

Attack surface

Context files — GEMINI.md and .gemini/.env are read as trusted instructions; anything in a cloned repo can carry a payload.
Shell execution — run_shell_command runs on the host; sandboxing (toolSandboxing) can be disabled by the user.
MCP servers — mcpServers entries in settings.json and extensions wire agents to arbitrary local and remote tools.
Inherited permissions — Workspace agents inherit years of over-broad folder and group sharing.
Personal accounts — a personal Google login on a corp device bypasses Workspace admin governance entirely.

Documented in the wild

CVSS 10.0 CLI chain — a malicious .gemini/.env in a pull request achieved host-level code execution before the sandbox; --yolo ignored allowlists, enabling CI secret exfiltration (patched).
README-borne exfil — a poisoned README.md hid a command that silently exfiltrated environment variables.
Antigravity injection — hidden 1-pt-font web instructions exfiltrated credentials past default file protections; multiple related holes disclosed.

Native controls are switches, not sensors. Workspace admin turns Gemini services on or off per license; Gemini CLI's system-defaults.json and Trusted Folders set static policy. None of it observes runtime behavior — what the shell actually executed, which MCP tools were invoked, or what a --yolo session touched. And none of it sees personal accounts or non-Google agents on the same machine.

Admin plane integration

We plug into your Google admin plane

Ospiri connects to Workspace Admin and Google Cloud's Gemini surfaces — and fills in what event logs structurally can't show.

What Google's admin plane exposes

Workspace Admin console — Gemini on/off per OU/group, data-grounding and sharing toggles, retention (auto-delete), and Gemini usage reports per app and feature.
Admin SDK Reports API — Gemini-in-Workspace audit events (which app, which feature, which user) feeding the security investigation tools. Events — not content, not actions.
Cloud console "Admin for Gemini" — Code Assist seats and access, plus Cloud Monitoring metrics (suggestions shown/accepted, tokens) and Cloud Logging for the IDE and CLI.
DLP & AI classification — label-based rules restricting what Gemini can reach.

What Ospiri does with it

Ingest & correlate — Reports API events and Code Assist metrics are joined with kernel telemetry: Google logs that Gemini was used; Ospiri shows what the CLI's shell actually executed.
Close the console's blind spots — personal-account sessions, --yolo runs, and non-Google agents on the same host never reach Workspace Admin; Ospiri sees all three.
Push policy back — findings map onto OU-level Gemini controls and DLP labels, so enforcement lands in both planes.

Endpoint or cloud — same firewall. Coverage applies whether Gemini runs as a CLI on a laptop, in Chrome, or as an agent built on Vertex AI / GCP: admin-plane signals in, runtime control at the point of action.

The fix

How Ospiri governs Gemini

Visibility

Inventory every Gemini runtime on the fleet — CLI, Code Assist, Chrome agent sessions — running or dormant. Detect personal-account sessions Workspace admin can't see.

Sandboxing

Kernel-level enforcement that holds even when the user runs --yolo or disables toolSandboxing: secret and path fences, network containment, and copy-on-write for risky writes.

Anomalies

Per-agent baselines flag the CLI session that starts exfiltrating env vars, hitting new domains, or touching paths it has never read — with replayable evidence.

Skills

Scan GEMINI.md, .gemini/.env, and extension bundles for injected instructions and embedded secrets before the agent loads them; re-scan on every update.

MCP

Discover every mcpServers entry, monitor tool-call traffic in flight, and enforce per-agent allow-lists across system, workspace, and user scopes.

The Gemini Firewall