Gemini CLI 0.60 hardens extensions, sandboxes, and MCP OAuth

Google’s open-source Gemini CLI shipped stable v0.60.0 on September 15, 2026. This release is less about a new model than about tightening the boundaries around extensions, sandboxes, web fetching, and Model Context Protocol (MCP) authentication.

Extensions now ask before changing the environment

Extensions can request environment changes, but Gemini CLI now prompts for user consent and sanitizes runtime-altering environment variables. The goal is to make extension behavior more explicit instead of allowing an installed extension to silently alter the execution environment.

The release also strengthens extension path resolution and workspace-boundary validation. Symlink handling is hardened, and the CLI mitigates NTFS 8.3 short-name paths in command-safety and file-discovery utilities. These controls matter when an agent can inspect or modify files across a large or shared workspace.

Stronger sandbox and output boundaries

Version 0.60.0 isolates settings and temporary directories inside sandbox containers and adds macOS Seatbelt path isolation. It also tightens permission and ownership checks on system-wide configuration paths.

The core now enforces envelope metadata provenance for untrusted tool outputs. That is useful for reducing ambiguity about where tool results came from, but it does not make an external tool trustworthy by itself. Teams should continue to review MCP servers, extensions, and shell permissions before enabling them in sensitive repositories.

MCP OAuth and web fetch safety

The release implements strict RFC 9207 issuer identification in the MCP OAuth flow. It also improves destination validation and connection routing in web-fetch utilities. Together, these changes reduce the chance that a connection or authentication flow is accepted merely because it looks structurally valid.

The stable release is marked latest by the Gemini CLI project. Upgrade testing should include custom extensions, MCP OAuth login, sandboxed commands, symlink-heavy repositories, and any web-fetch workflow that relies on redirects or private-network blocking.

Sources

• Gemini CLI — stable v0.60.0 changelog (September 15, 2026): https://geminicli.com/docs/changelogs/latest/
• Gemini CLI — official v0.60.0 release: https://github.com/google-gemini/gemini-cli/releases/tag/v0.60.0
• Gemini CLI — complete changelogs: https://geminicli.com/docs/changelogs/
• Google Gemini CLI — official repository: https://github.com/google-gemini/gemini-cli
• Google for Developers on X — official developer updates: https://x.com/googledevs