the short answer
It depends on how users authenticate. On Gemini Code Assist Standard or Enterprise and paid Gemini API keys, Google does not use prompts or responses to train its models; on the unpaid API tier, content may be used and human reviewers may read it. Locally, the sandbox is off by default and two 2026 CVEs reached code execution through workspace configuration. Pin the auth type, enable the sandbox, and use the admin policy engine.
- Training
- Not on Code Assist Standard/Enterprise or the paid API; may be used on the unpaid API tier
- Consumer access
- Login with Google ended June 18, 2026 for Code Assist for individuals and AI Pro/Ultra; Standard/Enterprise unchanged
- Code Assist
- No new sales since October 9, 2026; runs to contract end
- Sandbox
- Off by default; on by default with
--yolo - Admin controls
- System settings, admin policy engine, enterprise controls
Status as of October 2026
Google stopped serving Gemini CLI requests for Gemini Code Assist for individuals and Google AI Pro and Ultra on June 18, 2026, and points those users to Antigravity CLI. Gemini CLI remains available with paid Gemini API or Agent Platform keys and Code Assist Standard or Enterprise. Code Assist Standard and Enterprise stopped new sales on October 9, 2026; license additions and annual renewals end January 31, 2027, with no shutdown date announced.
What Happens to Your Code, by Sign-in Path
Pin the method with security.auth.enforcedType in system settings so developers cannot fall back to an unpaid key.
| Sign-in path | Terms | Training |
|---|---|---|
| Code Assist Standard or Enterprise | Google Cloud terms | “Gemini doesn’t use your prompts or its responses as data to train its models” |
| Paid Gemini API key | Gemini API paid terms | Not used to improve products; logged for a limited period for abuse detection |
| Unpaid Gemini API key (if still accepted by Gemini CLI) | Gemini API unpaid terms | Used to provide and improve products; human reviewers may read input and output |
| Vertex AI key | Google Cloud terms | Per Google Cloud terms |
What the Local Agent Can Do by Default
| Area | Default |
|---|---|
| Approval mode | default: prompts for approval; auto_edit and plan (read-only) also available |
| YOLO | Only by --yolo or --approval-mode=yolo; blocked by security.disableYoloMode |
| Sandbox | Disabled by default; enabled by --sandbox, GEMINI_SANDBOX or tools.sandbox, and by default with --yolo |
| Trusted folders | Untrusted folders run in safe mode (no project settings or .env loading); the docs conflict on whether folder trust is on by default, and the current source says it is |
| Local session files | Prompts, responses and tool executions saved for 30 days |
Gemini CLI Vulnerabilities
| ID | Disclosed | Impact | Fixed |
|---|---|---|---|
| Tracebit report (no CVE) | Jul 2025 | Prompt injection in a repository README plus a command-allowlist prefix bypass → silent command execution | 0.1.14 |
| CVE-2026-12537 | Apr 2026 | Headless mode auto-trusted the workspace and --yolo ignored tool allowlists → RCE in CI (critical) | 0.39.1 |
| CVE-2026-13745 | Sep 2026 | A malicious .env overrides GEMINI_CLI_HOME, loading attacker config past folder trust → code execution | 0.39.1 |
Admin Controls
Gemini CLI is not one of the harnesses Failproof hooks, so these vendor controls are the enforcement layer for it; Antigravity CLI is a supported Failproof harness. See where each agent reads admin policy.
| Control | Effect |
|---|---|
System settings.json | Overrides user and project settings; users with sufficient privileges can still change it |
security.disableYoloMode: true | No YOLO mode |
tools.core, mcp.allowed | Tool and MCP allowlists |
Admin policy engine (/etc/gemini-cli/policies and equivalents) | TOML rules at the admin tier, which always wins |
| Enterprise admin controls (Management Console) | Strict mode (no YOLO) on by default; extensions and MCP off by default; cannot be overridden locally |
FAQ
Can employees still use Gemini CLI with a personal Google account?
Not for Code Assist for individuals or Google AI Pro and Ultra since June 18, 2026. Google says Gemini CLI remains available with paid Gemini API keys, and possibly unpaid ones, so a personal key is still a route; that is why pinning the auth type matters.
Is the Gemini CLI sandbox on by default?
No, except with --yolo. Require it with tools.sandbox in system settings.
Does Failproof enforce policies on Gemini CLI?
No. Gemini CLI is not a supported Failproof harness; use its admin policy engine and enterprise controls.
Sources
Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.
- Google: Gemini Code Assist for individuals deprecation
- Google Developers Blog: Transitioning Gemini CLI to Antigravity CLI
- Google Cloud docs: Gemini Code Assist sunset
- Gemini CLI docs: Terms of service and privacy
- Google: Gemini API additional terms
- Google Cloud docs: Gemini data governance
- Gemini CLI docs: Sandbox
- Gemini CLI docs: Trusted folders
- Gemini CLI docs: Enterprise admin controls
- Gemini CLI docs: Policy engine
- Tracebit: Gemini CLI code execution via prompt injection (Jul 2025)
- GitHub advisory GHSA-wpqr-6v78-jr5g (CVE-2026-12537)
- NVD: CVE-2026-13745
- Failproof AI docs: Agent harnesses and enforcement capability