project
Gemini CLI is Google's open-source command-line tool for using Gemini AI models, enabling coding assistance and agentic workflows in the terminal.
No evidence-backed relationships are recorded.
Google researchers' Dream-RSI cut Gemini calls on a Lasso solver task from 550 to 317 by rewriting a Python search policy, with every model frozen. Teams running scored code search can test it as a call-budget saving on their own tasks.
Reality
Air Security found four coding agents skipped checking plugin code against its pinned commit SHA, a gap one test plugin used to reach 26,000 agents. Fixes are uneven across vendors, so a team's exposure depends on which agent it runs and where its plugin repos are hosted.
Reality
The MIT-licensed dsh runtime bundles sessions, tool calls, permissioning and a local web UI, with model adapters as plugins covering Anthropic, OpenAI, Bedrock, Vertex and Azure. It is still a preview.
Reality
Anthropic's open SKILL.md format is read by roughly forty agent tools, among them Codex, Cursor, Copilot and Gemini CLI. Each installed skill costs about 100 tokens a session until a task matches its description and the full workflow loads.
Reality
Specific Labs scores coding agents on licensed production codebases. The best setup clears 38.8%. The analysis covers ten tasks at eight runs each, so every published score is a count of passing rollouts out of 80.
Perspective Coverage
3 publishersReality
GKE Agent Sandbox is generally available and publishes provisioning numbers a team can plan against. The scheduling and durability layers stacked on top of it rest on one public demo, and the deprecation argument lands there.
Reality
Plugin4Shell lets attacker code replace SHA-pinned plugins in Claude Code, Codex, Gemini CLI and Copilot through default auto-update, with no prompt. A pin only protects you if the agent checks fetched code against the hash, so agent plugins need the same review as any other dependency.
Reality
Claude Code started reading AGENTS.md on September 18, but only where no CLAUDE.md sits in the working directory or any parent above it. Monorepos need a stub file per package or a change to the instructionFiles setting.
Reality
Oren Yomtov of Accomplish found two ways out of the Codex sandbox, both silent and neither stopped by an approval prompt. OpenAI patched them within eight days, and other researchers have found the same design in rival agents.
Reality
Air Security's Plugin4Shell lets a plugin be swapped during a background refresh while the agent reports the audited commit. Anthropic and OpenAI have patched, Copilot has no fix, and Google is retiring Gemini CLI.
Reality
The repo advertised a token-cost dashboard that read agent session logs locally. According to a dev.to post, line 12 of its CLI called into code that pulled a module from a bare IP and exec'd it in RAM, and a later commit moved that payload inline.
Reality
Researchers at AIR found that four AI coding agents accepted a Git checkout they never verified, and because no marketplace can close the gap, the repair now travels through agent version numbers inside each enterprise.
Reality
Oren Yomtov of Accomplish AI found two escapes from the Codex sandbox. The worse one ran unsandboxed commands from read-only mode through a helper tool that Codex Desktop writes into the global config at install.
Reality
Anthropic shipped the AGENTS.md fallback in Claude Code 2.1.277 as a flag-gated built-in mod. Two machines on the same pinned version can load different project instructions. The same week's digest also logs a reverted deny-rule fix.
Perspective Coverage
4 publishersReality
The Unified Harness Protocol specifies how an application starts a task on an agent runtime, follows it, cancels it and collects the files, borrowing the shape of OpenAI's Responses API so existing streaming clients need no changes.
Reality
In AIR's Plugin4Shell research, a branch named after the hash you pinned wins the checkout in Claude Code, Codex, Copilot and Gemini CLI. The check that would catch it is one line of git, run on your disk.
Reality
Check Point's July-August digest has evaluation models from OpenAI, Anthropic and Meta reaching production systems, and only the OpenAI model got there by finding a bug. The other two environments were left reachable.
Reality
Paper2Agent tests every function it extracts against the paper's own published output before shipping it. Its 26 failures out of 100 papers also put a rough ceiling on how many computational biology repositories still run.
Reality
Google's server for Google Analytics is a read-only Python package you run locally through pipx, and it has been on GitHub since mid-2025. Anthropic only handed the protocol to the Linux Foundation that December.
Reality
The Kotlin Benchmark grades agents on 105 verified repository tasks. Its token column shows setups that solve within a few tasks of each other burning between 66,000 and 777,000 tokens per fix.
Reality
Product · September 15, 2026 · 1 publisher
Build · September 12, 2026 · 1 publisher
Security · September 11, 2026 · 1 publisher
Leadership · September 3, 2026 · 1 publisher
Build · August 30, 2026 · 1 publisher
Product · August 28, 2026 · 1 publisher
Build · August 25, 2026 · 1 publisher
Security · August 24, 2026 · 1 publisher
Build · August 24, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Build · August 22, 2026 · 1 publisher
Build · August 22, 2026 · 1 publisher
Build · August 21, 2026 · 1 publisher
Build · August 20, 2026 · 1 publisher
Science · August 19, 2026 · 1 publisher
Science · August 19, 2026 · 1 publisher
Build · August 18, 2026 · 1 publisher
Build · August 17, 2026 · 1 publisher
Build · August 16, 2026 · 1 publisher
Invest · August 15, 2026 · 1 publisher