Google's Antigravity IDE vulnerable to data exfiltration and remote code execution via prompt injection
Google · Nov 25, 2025 · Coding agent
What happened
Security researchers including Johann Rehberger (Embrace The Red) and PromptArmor demonstrated that Google's Antigravity agentic IDE could be manipulated through indirect prompt injection to exfiltrate sensitive data from a developer's environment. Attackers planted hidden instructions in a seemingly harmless document that coerced the agent into reading the developer's .env file and leaking secrets. Rehberger documented five vulnerability classes including remote code execution, auto-execute bypasses, and data exfiltration via the read_url_content tool and image rendering. Google's own bug-hunters page listed the exfiltration and code-execution paths as known issues under active remediation.
Causal vector
Indirect prompt injection in an agentic IDE turned the agent's file and browser tools into an exfiltration channel
Source
Reported by Embrace The Red. Verified against the primary report.
Antigravity ships with powerful tools but no policy layer deciding which tool calls are acceptable. A spend firewall's category and approval rules apply the same lesson to the action layer: reading a .env file or exfiltrating secrets is a blocked category regardless of what the prompt says, and the deterministic gate sits outside the compromised model.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
State-sponsored group automates ~80–90% of a cyber-espionage operation using Claude Code and MCP tools
Anthropic (Claude Code, abused by a threat actor) · Nov 1, 2025
Windsurf Cascade coding agent leaks developer secrets via indirect prompt injection
Windsurf (Cascade) · Aug 21, 2025
Google Jules asynchronous coding agent vulnerable to multiple data exfiltration issues
Google (Jules) · Aug 13, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.