Gemini CLI — September 2026 Releases
5 releases in September 2026.
What's new in Gemini CLI, September 2026
Gemini CLI spends September hardening sandboxing, MCP OAuth and extension security
Gemini CLI's September 2026 releases were almost entirely security hardening, focused on sandbox isolation, MCP OAuth and extension loading. Five releases shipped, from v0.58.0 to v0.62.0.
On the sandbox side, macOS Seatbelt now isolates Docker and container runtime sockets and binaries (v0.58.0) and its temporary directory (v0.60.0), and v0.61.0 hardens filesystem boundaries and isolates runtime state. MCP changes include SSRF prevention in OAuth metadata discovery (v0.59.0), RFC 9207 issuer identification in the OAuth flow (v0.60.0), and workspace trust that fails closed and filters mcpServers in restricted mode. Extensions got stricter path validation and a consent prompt for environment changes. v0.61.0 also addresses indirect prompt injection via build file modifications and preserves explicit versioned Flash model IDs. v0.62.0 was mostly reliability: OAuth refresh tokens are retained on refresh, MCP tool call titles are formatted as structured signatures, and PTY file descriptor cleanup and border rendering were fixed.
- macOS Seatbelt sandbox isolates Docker and container runtime sockets and binaries (v0.58.0) and its temporary directory (v0.60.0)
- Workspace trust now fails closed and filters mcpServers in restricted mode (v0.59.0)
- MCP OAuth: SSRF prevention in metadata discovery (v0.59.0) and RFC 9207 issuer identification (v0.60.0)
- Extensions prompt for consent on environment changes and validate paths more strictly (v0.60.0)
- Protection against indirect prompt injection via build file modifications; explicit versioned Flash model IDs preserved (v0.61.0)
- OAuth refresh tokens retained on refresh; PTY file descriptor cleanup improved (v0.62.0)
Upgrading from v0.57.0? See every change through v0.62.0.
- v0.62.0 (September 29, 2026) — Gemini CLI v0.62.0 is here with improved reliability, including better handling of authentication tokens and smoother tool integration with clearer fo
- v0.61.0 (September 23, 2026) — Gemini CLI v0.61.0 strengthens security with improved protection against prompt injection attacks and hardens sandbox isolation for safer execution. W
- v0.60.0 (September 15, 2026) — Gemini CLI v0.60.0 strengthens security with improved connection validation and tighter controls on how extensions access your system. This release al
- v0.59.0 (September 8, 2026) — Gemini CLI v0.59.0 strengthens security with critical fixes to prevent unauthorized access and adds stricter workspace protection controls. These upda
- v0.58.0 (September 1, 2026) — Gemini CLI v0.58.0 is here with improved sandbox security on macOS and smarter error handling that clears up confusing messages when switching between