Poisoned web page makes Google Antigravity's agent bypass its file guard and leak secrets
PromptArmor showed that a prompt injection hidden in 1-point text on an online integration guide could manipulate Gemini in Google's Antigravity coding tool into collecting credentials and code from the user's workspace. Although the default settings blocked the agent from reading files listed in .gitignore, it used the cat terminal command to dump the .env file, then had a browser subagent visit an attacker-monitored webhook.site URL carrying the data; webhook.site was on Antigravity's default browser allowlist. Google's bug bounty page listed data exfiltration through the browser agent as a known issue it was working to fix.
Antigravity's onboarding encouraged a default mode that lets Gemini decide when to bring a human into the loop. PromptArmor said Google's approach was to include a disclaimer about the existing risks.
What would have stopped it
Enforce file-access limits at the system level rather than per tool, and keep request-logging services off agent allowlists.
Guardrails
- G1 Least privilege Partial A .gitignore file guard existed, but terminal access let the agent read the .env file anyway.
- G2 Human confirmation Failed Default settings let Gemini decide when to involve a human, so no one approved the exfiltration.
- G3 Isolation Failed The default browser allowlist included webhook.site, a public request-logging service.
- G4 Instruction integrity Failed Gemini followed instructions hidden in 1-point font on a web page.
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
- G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
- G8 Recovery Not assessed Could the damage be undone?
Sources
-
“Google Antigravity is susceptible to data exfiltration via indirect prompt injection through the agentic browser subagent.”
-
“He also points to Google's Bug Hunters page for Antigravity which lists both data exfiltration and code execution via prompt injections through the browser agent as "known issues" (hence inadmissible for bug bounty rewards) that they are working to fix.”
Confidence 82% comes from these sources alone. How we score
History
- 14 Oct 2026Entered in the register with 2 sources