{
 "public_id": "AIR-2025-0180",
 "incident_id": "2025-11-google-antigravity-exfiltration",
 "date_disclosed": "2025-11-24",
 "date_occurred": null,
 "title": "Google Antigravity IDE: indirect prompt injection exfiltrates .env credentials and enables command execution",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "indirect_prompt_injection_web_page",
 "agent_capability_abused": [
  "web_browsing",
  "browser_subagent",
  "filesystem_read",
  "mcp_tool_use",
  "image_rendering"
 ],
 "target_product": "Google Antigravity",
 "target_vendor": "Google",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "credential_theft",
  "data_exfiltration",
  "remote_code_execution"
 ],
 "blast_radius": "all Antigravity users at launch; agents run unsupervised through the Agent Manager by default",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI05"
  ],
  "mitre_atlas": [
   "AML.T0051.001"
  ],
  "labels": [
   "browser_subagent_exfiltration",
   "gitignore_bypass",
   "dotenv_theft",
   "unicode_tag_characters",
   "known_issue_wontfix"
  ]
 },
 "defense_present": "default gitignore-based protection for sensitive files and an allowlist for browser navigation",
 "defense_bypassed": true,
 "fix_shipped": "Not fixed at disclosure - Google listed data exfiltration and code execution via prompt injection through the browser agent as 'known issues' and added an onboarding warning",
 "primary_sources": [
  "https://www.promptarmor.com/resources/google-antigravity-exfiltrates-data",
  "https://embracethered.com/blog/posts/2025/security-keeps-google-antigravity-grounded/"
 ],
 "verified_quote": "An indirect prompt injection in an implementation blog can manipulate Antigravity to invoke a malicious browser subagent in order to steal credentials and sensitive code from a user's IDE.",
 "confidence": "high",
 "notes": "PromptArmor demonstrated AWS credentials and private code being sent to a webhook.site URL via a browser subagent, with the payload hidden in 1px font on a fake Oracle ERP integration guide; the .env file was read despite gitignore protection. Johann Rehberger separately reported five issues (RCE via indirect injection, hidden instructions via Unicode Tag characters, unsupervised MCP tool invocation, exfiltration via read_url_content, exfiltration via image rendering), several of which he had originally reported to Windsurf in May 2025 and which shipped again in Antigravity.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Tool & Function Call Extraction / Abuse",
 "risk_sub_secondary": [
  "Prompt Injection",
  "Credential & Secret Theft",
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "Antigravity read .env and exfiltrated via its browser subagent",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_web_page",
 "guardrail_kind": [
  "permission_scope"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [
   "AML.T0051.001"
  ],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "google",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_exfiltration_channels",
 "eai_domain": "privacy",
 "eai_secondary": [
  "credential_theft",
  "privilege_escalation",
  "confused_deputy"
 ],
 "eai_reason": "impact rule: data_exfiltration_channels",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}