Google Antigravity Flaw Let Prompt Injection Bypass Secure Mode for Remote Code Execution
Summary
Pillar Security said a now-patched flaw in Google Antigravity let prompt injection abuse the native find_by_name tool to bypass Secure Mode and achieve remote code execution. Google patched it Feb. 28 after a Jan. 6 report.
Key points
- Pillar Security disclosed a vulnerability in Google’s Antigravity developer tool; Google patched it on Feb. 28 after receiving a report on Jan. 6 and awarded a bug bounty.
- The reported exploit combined prompt injection with Antigravity’s permitted file-creation capability to achieve remote code execution.
- The native find_by_name tool could run before Secure Mode evaluated command-level operations, allowing the attack to bypass its sandbox protections.
- Malicious instructions could reach the agent through compromised connected accounts or through files and web content it ingested; the article says no elevated access was needed if the agent read a malicious document.
- Pillar Security researcher Dan Lisichkin said native tool parameters reaching shell commands should be audited and called for moving beyond sanitization-based controls.
Article Details
- Vulnerability Types
- Prompt injection
- Sandbox escape
- Remote code execution
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available