Disclosed vulnerability
Google Antigravity IDE: indirect prompt injection exfiltrates .env credentials and enables command execution
AIR-2025-0180 AIR record · 2025-11-google-antigravity-exfiltration
From the supporting source
An indirect prompt injection in an implementation blog can manipulate Antigravity to invoke a malicious browser subagent in order to steal credentials and sensitive code from a user's IDE.promptarmor.com
The record
Disclosed
2025-11-24
Vendor
Google
Product
Google Antigravity
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft, Privilege escalation, Confused deputy
System type
Generative model
Who acted
Agent acted — Antigravity read .env and exfiltrated via its browser subagent
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection web page
Impact type
Credential theft, Data exfiltration, Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
all Antigravity users at launch; agents run unsupervised through the Agent Manager by default
Capability abused
Defense & remediation
Recorded defense
default gitignore-based protection for sensitive files and an allowlist for browser navigation
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
Not fixed at disclosure - Google listed data exfiltration and code execution via prompt injection through the browser agent as 'known issues' and added an onboarding warning
Taxonomy & references
Curator notes
PromptArmor demonstrated AWS credentials and private code being sent to a webhook.site URL via a browser subagent, with the payload hidden in 1px font on a fake Oracle ERP integration guide; the .env file was read despite gitignore protection. Johann Rehberger separately reported five issues (RCE via indirect injection, hidden instructions via Unicode Tag characters, unsupervised MCP tool invocation, exfiltration via read_url_content, exfiltration via image rendering), several of which he had originally reported to Windsurf in May 2025 and which shipped again in Antigravity.
Supporting sources
Cite as
Enkrypt AI. "Google Antigravity IDE: indirect prompt injection exfiltrates .env credentials and enables command execution". AIR, AIR-2025-0180. https://agentincident.vercel.app/i/AIR-2025-0180/ (accessed 2026-10-19).