Gemini CLI 0.61–0.62 hardens sandbox boundaries and adds current Flash models

Google’s Gemini CLI v0.61.0 is the latest stable release as of September 23, 2026. Its headline changes focus on safer agent execution and more predictable model routing.

Prompt-injection and sandbox hardening

The release prevents indirect prompt-injection paths that use build-file modifications and untrusted command flags. It also hardens filesystem boundaries and isolates internal runtime state inside sandbox environments.

These changes reduce the surface available to untrusted repository content and commands, but they do not make an agent automatically safe. Keep least-privilege credentials, review tool approvals, and test the exact sandbox configuration used in CI or a developer workstation.

Model routing and agent-loop reliability

Gemini CLI 0.61.0 preserves explicit versioned Flash model IDs and uses them directly during routing and execution. That avoids silently replacing a pinned model identifier when a workflow depends on a particular version.

The release also ensures that internal AgentLoopContext properties survive object-spread operations, improving reliability in the main agent loop. The full release includes related fixes carried from the preview line.

September 29 follow-up: stable release 0.62.0

The Gemini CLI GitHub releases page marks v0.62.0 as the latest release and dates it September 29. Its included model-support change adds Gemini 3.8 Flash (gemini-3.8-flash) and Gemini 3.5 Flash Lite (gemini-3.5-flash-lite) as the latest GA models in their tiers, while retaining Gemini 3.5 Flash and Gemini 3.1 Flash Lite as base-tier choices.

The official implementation updates model routing, fallbacks, quota aggregation, and the model picker. The linked change says USE_GEMINI, USE_VERTEX_AI, and GATEWAY authentication paths receive the newer models without experiment-flag checks; Google-login Code Assist paths remain subject to the corresponding access flags. Confirm the model picker and account eligibility before pinning a model ID in scripts.

Upgrade guidance

Install the stable release in a test environment first. Verify filesystem access, build tools, extension behavior, explicit model IDs, and the failure mode for untrusted flags before upgrading unattended agents. Treat a more restrictive sandbox as a behavior change: scripts that previously relied on broad filesystem access may now need an explicit, reviewed configuration.

Sources

• Gemini CLI — “Latest stable release: v0.61.0” (September 23, 2026): https://geminicli.com/docs/changelogs/latest/
• Gemini CLI — release notes: https://geminicli.com/docs/changelogs/
• Google Gemini CLI — GitHub release v0.61.0: https://github.com/google-gemini/gemini-cli/releases/tag/v0.61.0
• Google Gemini CLI — GitHub release v0.62.0 (September 29, 2026): https://github.com/google-gemini/gemini-cli/releases/tag/v0.62.0
• Google Gemini CLI — model-support change #29443: https://github.com/google-gemini/gemini-cli/pull/29443
• Google for Developers on X — official developer updates: https://x.com/googledevs