Google Antigravity Patch Leaves Prompt Injection Risk Exposed
Prompt injection can still break the trust boundary in agentic AI tools. In Google Antigravity, permitted file creation and native tool calls were enough to bypass Secure Mode and reach remote code execution, so the standard response of relying on sandboxing alone misses the real failure: the agent can be tricked into treating attacker-controlled content as instructions.
Pillar Security disclosed the flaw and Google has patched it. The issue affected Antigravity, Google’s AI-powered developer tool for filesystem operations, and it specifically defeated Secure Mode, which is meant to run commands in a virtual sandbox, throttle network access, and block writes outside the working directory.
The forward risk is that any agent platform that mixes file access, native tools, and prompt ingestion can turn untrusted content into code execution. Sandbox controls still matter, but they do not help if the agent itself can be induced to invoke privileged native functions before those controls apply.