← Back to feed

Researchers at Pillar Security disclosed a critical vulnerability in Antigravity, Google’s agentic IDE for filesystem operations, that enabled remote code execution by exploiting the agent’s own file search tool. The flaw bypassed Secure Mode — Google’s most restrictive security configuration — because it operated at a layer the security boundary never evaluated.

Antigravity launched in November 2025 as a coding environment where autonomous agents can read, write, and search files to assist developers. Secure Mode is supposed to restrict network access, prevent out-of-workspace writes, and sandbox all command operations.

The Flaw

Antigravity’s find_by_name tool accepts a Pattern parameter for searching files. The parameter was passed directly to the fd command-line utility without sanitization. Because strings beginning with - were interpreted as flags rather than search patterns, an attacker could inject arbitrary command-line flags into the underlying fd call.

The critical flag is -X (exec-batch). When passed to fd, it executes a specified binary against each matched file. Injecting -Xsh through the Pattern parameter caused fd to pass matched files to the shell for execution as scripts.

Spaces in the injected string prevented direct argument passing — a limitation that turned out not to matter. Because Antigravity’s standard permitted actions include creating files in the workspace, the attack chain needed no external capability:

1. Attacker delivers prompt injection through compromised identity accounts, open-source files, or any web content the agent ingests.
2. Agent stages a malicious script as a normal file creation operation.
3. Agent triggers find_by_name with an injected Pattern.
4. fd executes the staged script.
5. Arbitrary code runs on the developer’s machine.

No additional user interaction required once the prompt injection lands.

Why Secure Mode Failed

The core reason the exploit bypassed Secure Mode is classification. find_by_name is a native tool — the agent executes it directly, before Secure Mode’s command-level restrictions are evaluated. The security boundary that Secure Mode enforces never sees native tool invocations; it only intercepts shell commands. Since the agent treated the tool call as a native filesystem operation rather than a shell command, every Secure Mode control — sandboxing, network restriction, out-of-workspace write prevention — was irrelevant.

Pillar’s writeup frames this as a structural problem: sanitization-based security controls fail when the attack surface is a native tool that reaches shell commands through a different path. The “secure” label accurately described what Secure Mode could prevent. It did not describe the full attack surface.

Timeline

• January 7, 2026: Pillar Security reports to Google via AI Vulnerability Rewards Program with direct prompt injection proof of concept.
• January 7, 2026: Google accepts the report and files an internal bug.
• January 24, 2026: Google marks the issue as fixed internally.
• February 28, 2026: Confirmed fixed. Google awards bug bounty.
• April 20-21, 2026: Pillar publishes full research disclosure.

Implications for Agentic Tooling

The Antigravity case illustrates a pattern that has not been formally addressed across the industry. Agents that perform file operations, web fetches, or any action that ingests external content can receive prompt injection through that content. If native tool parameters reach shell commands — even indirectly — any injected value is an execution path.

Pillar’s recommendation is a shift from sanitization-based controls to execution isolation: every native tool that eventually reaches a shell command should be treated as a potential injection point at the architecture level, not handled at the string-sanitization layer. That standard does not yet exist in most agentic product specifications.

The Antigravity flaw is now patched. The class of vulnerability it represents is not.