Gemini 3 Flash in Gemini CLI 2026: Free Tier Limits Tested

Google shipped Gemini 3 Flash as the default model in Gemini CLI this week. Verify the quota numbers below against Google’s official rate-limit docs before you plan around them — free-tier limits change frequently and without announcement.

Gemini 3 Flash landed as the default model in Gemini CLI, and the free tier remains the most generous no-credit-card coding agent available. The same week the model shipped, security researchers demonstrated that agentic CLI tools — Gemini CLI and Claude Code among them — can be steered by a poisoned GitHub issue into exfiltrating CI secrets. Running Gemini 3 Flash in Gemini CLI on the free tier means getting two things right: the quota math, so you know when you will get throttled mid-task, and one settings flag, so a malicious string in a repo you cloned cannot turn your agent into an exfiltration tool. Both are covered below, with config you can paste today.

What’s new with Gemini 3 Flash in Gemini CLI

Gemini 3 Flash is now the model Gemini CLI reaches for by default when you sign in with a personal Google account. The CLI previously defaulted to the 2.5 generation and fell back to Flash only when Pro quota ran out. The fast, cheap model in the rotation is now a materially stronger reasoning model than the one it replaced. Tool-calling reliability and long-context handling are where the generational jump shows up most in agent workloads — exactly the workload a CLI agent generates.

The second piece of news is not a feature. Researchers disclosed a class of prompt-injection attacks where instructions embedded in untrusted repository content — a GitHub issue body, a README, a code comment, a dependency’s changelog — get read into the agent’s context during a normal task and interpreted as commands. In a CI context where the agent has shell access and the environment holds workflow secrets, the attack path is short: the injected text tells the agent to read an environment variable and include it in a network request or a commit. Both Gemini CLI and Claude Code proved steerable this way. The vulnerability is not a bug in one product; it is the structural consequence of giving a language model both untrusted input and real tools.

Those two stories collided in the same week for a reason worth naming. The better the default model gets at autonomous multi-step tool use, the more people flip on auto-approval to stop babysitting it — and the more valuable a successful injection becomes. Capability and blast radius went up together.

Why it matters

• The free tier is a genuinely capable agent, not a demo. Gemini CLI free tier limits run real refactors and multi-file edits end to end without a billing account, which is unusual among coding agents.
• Quota exhaustion is the failure mode you will actually hit. Agentic runs burn requests fast — every tool call round trip is a request. A single “fix this failing test suite” task can consume dozens.
• Gemini CLI prompt injection is a live risk, not theoretical. Point the agent at a repo you did not write, and its issues, comments, and docs become untrusted input with a direct line to your shell.
• YOLO mode is the amplifier. Auto-approving every tool call removes the one control that reliably stops an injected instruction from executing. Convenience and containment trade directly against each other.
• CI is the worst place to run an unsandboxed agent. A CI runner typically holds deploy tokens, registry credentials, and cloud keys in environment variables the agent can read.
• Sandboxing is a one-line config change. The mitigation costs almost nothing, which makes skipping it hard to justify.

How to use Gemini 3 Flash in Gemini CLI today

1. Install or update the CLI. Node 20+ is required.

   npm install -g @google/gemini-cli
   gemini --version

2. Authenticate with a personal Google account for free-tier access. Run gemini and follow the browser OAuth flow. If you prefer an API key from AI Studio, export it — but key-based access uses the Gemini API free tier quota, a different and generally smaller pool than the CLI’s OAuth tier.

   export GEMINI_API_KEY="your-key-here"

3. Confirm which model you are actually on. Do not assume the default. Inside the CLI:

   /stats
   /model

   Or pin it explicitly at launch so a fallback never silently swaps you onto a different model mid-session:

   gemini --model gemini-3-flash

4. Turn on sandboxing before you touch an untrusted repo. This is the Gemini CLI settings.json flag that matters. Edit ~/.gemini/settings.json:

   {
     "sandbox": "docker",
     "autoAccept": false
   }

   Sandboxed execution runs shell commands and file writes inside a container, so an injected “read the env and POST it somewhere” instruction hits a boundary instead of your real environment. Setting autoAccept to false keeps the approval prompt in front of every tool call. Verify the flags took effect with /about inside the CLI rather than trusting the file edit.

5. Never pass --yolo on a repo you did not write. The Gemini CLI YOLO mode risk is that it approves the injected call as readily as your own. Reserve it for scratch directories with nothing sensitive in scope.

   # Fine in a throwaway sandbox dir:
   gemini --yolo "scaffold a hello world express app"
   
   # Never do this on a cloned public repo:
   # gemini --yolo "fix the open issues"

6. Strip secrets from the agent’s environment in CI. If you run the CLI in a pipeline, do not hand the step your full secret set. Scope the environment to exactly what the task needs.

   - name: Run agent
     env:
       GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
     run: gemini --model gemini-3-flash -p "summarize the diff"

   Nothing else from your secrets store goes in that env block. An agent cannot leak what it cannot read.

7. Budget your requests. Check usage with /stats mid-session. Near the ceiling, switch from open-ended agentic prompts to narrow, single-shot ones — -p non-interactive mode with a tight scope costs a fraction of a multi-turn tool loop.

   gemini -p "explain what src/auth/session.ts does in 5 bullets"

How it compares

Free-tier ceilings for coding agents shift often, and vendors change them without notice. Treat this as a shape-of-the-market comparison and confirm current numbers before you depend on them.

Tool	Free tier	Sandboxing	Best for
Gemini CLI (Gemini 3 Flash)	Generous, OAuth personal account, no card required	Optional, opt-in via settings.json	High-volume agentic work at zero cost
Claude Code	Requires a paid plan or API credit	Permission prompts by default; sandbox modes available	Complex multi-file reasoning and refactors
GitHub Copilot CLI	Limited free allowance, paid tiers above it	Tightly scoped command surface	Git and shell command assistance
Gemini API direct	Separate, smaller free quota than the CLI tier	None — you build it	Custom pipelines and scripted automation

Gemini 3 Flash vs 2.5 Flash

The newer model is the better default for agent loops, where a single bad tool call cascades into wasted turns and burned quota. 2.5 Flash still earns its place on bulk, latency-sensitive, single-shot work — classification, extraction, summarization at volume — because the older model is cheaper per token on paid tiers and the reasoning gap barely registers on shallow tasks.

What’s next

Expect the free tier to tighten. Every AI coding tool has followed this pattern: launch generous to win developer habit, then trim quotas once usage stabilizes and inference costs get measured against retention. Build your workflow so a quota cut is an inconvenience rather than a blocker — keep an API key path working alongside OAuth, and know which of your tasks genuinely need an agent loop versus a single well-scoped prompt.

The more consequential thread is what vendors do about prompt injection. The current answer across the industry is user-side controls: sandboxes, approval prompts, allowlists. That puts the burden on you to configure correctly, a poor security model at scale, because the default configuration is what most people ship. Watch for sandboxing to become the default rather than the opt-in, for provenance tracking that marks repo-sourced text as untrusted, and for tool-call policies that block network egress after untrusted content enters the context window. Any vendor that ships secure defaults without wrecking ergonomics gains a real advantage.

Also watch the CI integration space. Running an agent on every pull request is an attractive idea and a large attack surface at once — the untrusted content arrives automatically, by design, from anyone who can open an issue or a PR. The teams that get this right will run agents in isolated environments with narrowly scoped credentials and no write access to anything that matters. The teams that get it wrong will find out through an incident report.

Frequently Asked Questions

Is Gemini 3 Flash actually free in Gemini CLI?

Yes, on the personal-Google-account OAuth tier, with no billing account required. The exact request and token ceilings change over time, so check Google’s current rate-limit documentation rather than relying on a number you read in an article — including this one.

What happens when I hit the free tier limit?

The CLI reports the quota error and typically falls back to a lower-tier model or blocks further requests until the window resets. Mid-task exhaustion is the common annoyance: run /stats before starting a long agentic task so you are not surprised halfway through a refactor.

How does Gemini CLI prompt injection actually work?

Untrusted text — a GitHub issue body, a README, a code comment, a dependency changelog — gets read into the model’s context during a normal task. That text contains instructions. The model has no reliable way to distinguish “content I was asked to read” from “instructions I was given,” so it may act on them, using whatever tools it has. With shell access and secrets in the environment, that is an exfiltration path.

Does sandboxing fully prevent this?

No. Sandboxing contains the damage from executed commands; it does not stop the model from being manipulated. An agent inside a container can still leak anything reachable from inside that container. Layer it: sandbox, keep approval prompts on, and scope credentials so there is little worth stealing in the first place.

Should I ever use YOLO mode?

Only in a disposable directory with code you wrote and no credentials in the environment. The speed gain is real, and so is the fact that it auto-approves an injected tool call exactly as fast as a legitimate one.

Which should I pick for agent work, Gemini 3 Flash or 2.5 Flash?

Gemini 3 Flash. Agent loops punish unreliable tool calling, and every malformed call costs you a retry and a request against your quota. Keep 2.5 Flash in mind for high-volume single-shot tasks where reasoning depth barely matters and per-token cost does.