> Gemini is not supposed to have access to .env files in this scenario (with the default setting ‘Allow Gitignore Access > Off’). However, we show that Gemini bypasses its own setting to get access and subsequently exfiltrate that data.

They pinky promised they won’t use something, and the only reason we learned about it is because they leaked the stuff they shouldn’t even be able to see?

This is hillarious. AI is prevented from reading .gitignore-d files, but also can run arbitrary shell commands to do anything anyway.

When I read this I thought about a Dev frustrated with a restricted environment saying "Well, akschually.."

So more of a Gemini initiated bypass of it's own instructions than malicious Google setup.

Gemini can't see it, but it can instruct cat to output it and read the output.

Hilarious.

As you see later, it uses cat to dump the contents of a file it’s not allowed to open itself.

Can we state the obvious of that if you have your environment file within your repo supposed protected by .gitignore you’re automatically doing it wrong?

For cloud credentials you should never have permanent credentials anywhere in any file for any reason best case or worse case have them in your home directory and let the SDK figure out - no you don’t need to explicitly load your credentials ever within your code at least for AWS or GCP.

For anything else, if you aren’t using one of the cloud services where you can store and read your API keys at runtime, at least use something like Vault.