I use Gemini CLI daily (work is a Google shop), directly (no kilocode). I've never seen anything like that.

I wonder if it could be something to do with the kilocode integration.

But, I do more commonly run with permission required for many operations, because I find it works much better if I help it every now and then. It can get stuck on some pretty simple stuff.