# Antigravity Grounded! Security Vulnerabilities in Google's Latest IDE

Google Antigravity IDE auto-executes AI-chosen terminal commands and MCP tools, letting indirect prompt injection (incl. hidden Unicode Tag chars) run remote scripts and exfiltrate .env secrets.

- Payout: Research
- Severity: high
- Program: Google
- Write-up by: Johann Rehberger
- Disclosed: 2025-11-25
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2025/security-keeps-google-antigravity-grounded/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-security-keeps-google-antigravity-grounded
- Tags: area:ai domain:ai domain:desktop impact:data-leak impact:rce kind:research platform:research sev:high tech:llm technique:unicode-normalization vuln:info-disclosure vuln:prompt-injection vuln:rce vuln:secrets-leak

**Target:** AI coding IDE (Gemini/Claude-backed agent with run_command, read_file, read_url_content, MCP tools)
**Root cause:** The IDE defaults to letting the AI decide whether terminal commands are 'safe' and auto-executes them without human-in-the-loop; MCP tool invocations also lack any approval gate, so model-level refusals are the only barrier.
**Steps:**
1. Plant instructions in a source file or tool/MCP response (e.g. a Linear ticket) that hijack the model, optionally hidden via Unicode Tag characters invisible in the UI.
2. Bring the file/ticket into chat context so Antigravity forwards it to Gemini/Claude.
3. Model invokes run_command to `curl` a remote script and pipe to bash, executing attacker code (demo launches calc).
4. For exfiltration: model calls `read_file` on `.env`, then sends contents to attacker via `read_url_content` or by rendering a markdown image pointing at an attacker server.
**How found:** Author revisited vulnerabilities previously reported to Windsurf in May 2025 and tested whether the Windsurf-derived Antigravity inherited them; built fresh payloads and found model refusals to curl|bash were bypassable with a few tricks.
**Exploitation:** Attacker-controlled content (source file, MCP tool result like a Linear ticket) enters the agent context; hidden or visible instructions steer the model to auto-run a curl|bash remote script for RCE, or to read .env and exfiltrate via read_url_content / image markdown requests to a third-party server, all without developer approval.
**Escalation:** Chaining hidden Unicode Tag instructions with auto-executed MCP tools yields full workstation compromise (classic RCE) plus data theft, bypassing code review since payloads are invisible.
**Insight:** Model refusals are suggestions, not security boundaries: when an agent auto-executes tools, treat any context source (source files, MCP tool outputs, tickets) as attacker-controlled and test hidden Unicode Tag smuggling plus curl|bash and read_file->read_url_content chains.