Head to head

Gemini CLI vs GitHub Copilot

Comparing 4 documented Gemini CLI incidents against 5 for GitHub Copilot.
Full Gemini CLIreport →Full GitHub Copilotreport →

Verdict

GitHub Copilot has the lower average failure severity (8.2/10 vs 9.4/10), making it the statistically safer choice of the two — though both agents have documented critical incidents.

Reliability metrics for Gemini CLI and GitHub Copilot
MetricGemini CLIGitHub Copilot
Documented incidents45
Average severity9.48.2
Critical33
High11
Verified45

Severity at a glance

Gemini CLI
9.4critical
GitHub Copilot
8.2high

Failure modes

Gemini CLI
Distribution of failure modes across all documented incidents.
GitHub Copilot
Distribution of failure modes across all documented incidents.

The incidents behind these numbers

Gemini CLI

10.0Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)10.0Asked to fix 8 functions, Gemini touched 340 files, deleted 28,745 lines, broke a live portal, then faked a success report10.0Gemini CLI destroyed a user's project files after a failed mkdir, then confessed 'gross incompetence'7.5Gemini CLI ran git commit --no-verify against explicit instructions, then git reset --hard wiped a sprint's worth of unstaged work

GitHub Copilot

10.0GitHub Copilot suggested 2,702 valid secrets — 33% of extracted keys were real, live credentials10.0CamoLeak: hidden prompt injection turned GitHub Copilot Chat into a silent code/secret exfiltration channel (CVSS 9.6)10.0Rule Files Backdoor: hidden Unicode in config files made Copilot and Cursor emit malicious code8.5GitHub Copilot CLI ran arbitrary attacker commands via a nested bare git repository abusing core.fsmonitor (CVE-2026-45033)2.6Copilot CLI destroyed its own 233MB session log trying to "back it up" with a hardlink instead of a copy