{
 "public_id": "AIR-2026-0165",
 "incident_id": "2026-07-google-antigravity-tasks-json-timebomb",
 "date_disclosed": "2026-07-20",
 "date_occurred": null,
 "title": "A time bomb in .vscode: Antigravity's write blocklist omits tasks.json, so an injected agent plants a folderOpen task that runs on the next restart",
 "class": "responsible_disclosure",
 "attack_surface": "coding_agent",
 "initial_vector": "indirect_prompt_injection_to_workspace_config_write",
 "agent_capability_abused": [
  "write_to_file",
  "vscode_task_auto_execution"
 ],
 "target_product": "Google Antigravity",
 "target_vendor": "Google",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution"
 ],
 "blast_radius": "Antigravity users in Secure Mode who restart the IDE after an injected session",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI04",
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "sandbox_escape",
   "secure_mode_bypass",
   "delayed_execution",
   "blocklist_gap",
   "social_engineering_the_user"
  ]
 },
 "defense_present": "Antigravity Secure Mode plus a blocklist of protected file paths under .vscode",
 "defense_bypassed": true,
 "fix_shipped": "not patched at publication",
 "primary_sources": [
  "https://www.pillar.security/blog/a-time-bomb-in-vscode-bypassing-antigravitys-secure-mode"
 ],
 "verified_quote": "The agent is sandboxed. Writing tasks.json is allowed, because it's the one name in .vscode that never made the blocklist.",
 "confidence": "high",
 "notes": "Pillar Security (Dan Lisichkin), Day 7 of the 'Week of Sandbox Escapes'. The injection also instructs the agent to tell the user to restart Antigravity, so the human triggers the payload. Pillar's own conclusion is that blocklists are the wrong control here: 'The durable fix is not a better blocklist or even an allowlist of permitted file writes, since that only controls what the agent writes.'",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Prompt Injection",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the injected agent wrote a tasks.json that executes on restart",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_to_workspace_config_write",
 "guardrail_kind": [
  "permission_scope"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "google",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "confused_deputy"
 ],
 "eai_reason": "impact rule: privilege_escalation",
 "asi_curated": [
  "ASI01",
  "ASI04"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01,ASI04 | added ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}