Google Antigravity exfiltrates data via indirect prompt injection attack
1–10 of 227 posts
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#2I know that Cursor and the related IDEs touch millions of secrets per day. Issues like this are going to continue to be pretty common.
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#3Damn, i paste links into cursor all the time. Wonder if the same applies, but definitely one more reason not to use antigravity
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#4Sooner or later I believe, there will be models which can be deployed locally on your mac and are as good as say Sonnet 4.5. People should shift to completely local at that point. And use sandbox for executing code generated by llm.
Edit: "completely local" meant not doing any network calls unless specifically approved. When llm calls are completely local you just need to monitor a few explicit network calls to be sure. Unlike gemini then you don't have to rely on certain list of whitelisted domains.
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#5> Gemini is not supposed to have access to .env files in this scenario (with the default setting ‘Allow Gitignore Access > Off’). However, we show that Gemini bypasses its own setting to get access and subsequently exfiltrate that data.
They pinky promised they won’t use something, and the only reason we learned about it is because they leaked the stuff they shouldn’t even be able to see?
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#6Sooner or later I believe, there will be models which can be deployed locally on your mac and are as good as say Sonnet 4.5. People should shift to completely local at that point. And use sandbox for executing code generated by llm. Edit: "completely local" meant not doing any network calls unless specifically approved. When llm calls are completely local you just need to monitor a few explicit network calls to be su…
I've been repeating something like 'keep thinking about how we would run this in the DC' at work. The cycles of pushing your compute outside the company and then bringing it back in once the next VP/Director/CTO starts because they need to be seen as doing something, and the thing that was supposed to make our lives easier is now very expensive...
I've worked on multiple large migrations between DCs and cloud providers for this company and the best thing we've ever done is abstract our compute and service use to the lowest common denominator across the cloud providers we use...
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#7That's the bleeding edge you get with vibe coding
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#8Sooner or later I believe, there will be models which can be deployed locally on your mac and are as good as say Sonnet 4.5. People should shift to completely local at that point. And use sandbox for executing code generated by llm. Edit: "completely local" meant not doing any network calls unless specifically approved. When llm calls are completely local you just need to monitor a few explicit network calls to be su…
If you read the article you'd notice that running an LLM locally would not fix this vulnerability.
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#9Sooner or later I believe, there will be models which can be deployed locally on your mac and are as good as say Sonnet 4.5. People should shift to completely local at that point. And use sandbox for executing code generated by llm. Edit: "completely local" meant not doing any network calls unless specifically approved. When llm calls are completely local you just need to monitor a few explicit network calls to be su…
Why is the being downvoted?
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#10Sooner or later I believe, there will be models which can be deployed locally on your mac and are as good as say Sonnet 4.5. People should shift to completely local at that point. And use sandbox for executing code generated by llm. Edit: "completely local" meant not doing any network calls unless specifically approved. When llm calls are completely local you just need to monitor a few explicit network calls to be su…
it's already here with qwen3 on a top end Mac and lm-studio.