Disclosed vulnerability
A time bomb in .vscode: Antigravity's write blocklist omits tasks.json, so an injected agent plants a folderOpen task that runs on the next restart
AIR-2026-0165 AIR record · 2026-07-google-antigravity-tasks-json-timebomb
From the supporting source
The agent is sandboxed. Writing tasks.json is allowed, because it's the one name in .vscode that never made the blocklist.pillar.security
The record
Disclosed
2026-07-20
Vendor
Google
Product
Google Antigravity
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the injected agent wrote a tasks.json that executes on restart
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection to workspace config write
Impact type
Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Antigravity users in Secure Mode who restart the IDE after an injected session
Capability abused
Defense & remediation
Recorded defense
Antigravity Secure Mode plus a blocklist of protected file paths under .vscode
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
not patched at publication
Taxonomy & references
Curator notes
Pillar Security (Dan Lisichkin), Day 7 of the 'Week of Sandbox Escapes'. The injection also instructs the agent to tell the user to restart Antigravity, so the human triggers the payload. Pillar's own conclusion is that blocklists are the wrong control here: 'The durable fix is not a better blocklist or even an allowlist of permitted file writes, since that only controls what the agent writes.'
Supporting sources
Cite as
Enkrypt AI. "A time bomb in .vscode: Antigravity's write blocklist omits tasks.json, so an injected agent plants a folderOpen task that runs on the next restart". AIR, AIR-2026-0165. https://agentincident.vercel.app/i/AIR-2026-0165/ (accessed 2026-10-19).