Damn, i paste links into cursor all the time. Wonder if the same applies, but definitely one more reason not to use antigravity
Cursor is also vulnerable to prompt injection through third-party content.
Google Antigravity exfiltrates data via indirect prompt injection attack
21–30 of 227 posts
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#22Earlier quoted context omitted.
Why is the being downvoted?
Because it misses the point. The problem is not the model being in a cloud. The problem is that as soon as "untrusted inputs" (i.e. web content) touch your LLM context, you are vulnerable to data exfil. Running the model locally has nothing to do with avoiding this. Nor does "running code in a sandbox", as long as that sandbox can hit http / dns / whatever. The main problem is that LLMs share both "control" and "data…
Sorry, I didn't elaborate. But "completely local" meant not doing any network calls unless specifically approved. When llm calls are completely local you just need to monitor a few explicit network calls to be sure.
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#23> Gemini is not supposed to have access to .env files in this scenario (with the default setting ‘Allow Gitignore Access > Off’). However, we show that Gemini bypasses its own setting to get access and subsequently exfiltrate that data. They pinky promised they won’t use something, and the only reason we learned about it is because they leaked the stuff they shouldn’t even be able to see?
This is hillarious. AI is prevented from reading .gitignore-d files, but also can run arbitrary shell commands to do anything anyway.
I had this issue today. Gemini CLI would not read files from my directory called .stuff/ because it was in .gitignore. It then suggested running a command to read the file ....
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#24Sooner or later I believe, there will be models which can be deployed locally on your mac and are as good as say Sonnet 4.5. People should shift to completely local at that point. And use sandbox for executing code generated by llm. Edit: "completely local" meant not doing any network calls unless specifically approved. When llm calls are completely local you just need to monitor a few explicit network calls to be su…
At the time that there's something as good as sonnet 4.5 available locally, the frontier models in datacenters may be far better.
People are always going to want the best models.
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#25I mean, agent coding is essentially copypasting code and shell commands from StackOverflow without reading them. Or installing a random npm package as your dependency.
Should you do that? Maybe not, but people will keep doing that anyway as we've seen in the era of StackOverflow.
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#26Who would have thought that having access to the whole system can be used to bypass some artificial check. There are tools for that, sandboxing, chroots, etc... but that requires engineering and it slows GTM, so it's a no-go. No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. EDIT: they did, but left a site that enables arbitrary redirects in the de…
> No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic.
This is the only way. There has to be a firewall between a model and the internet.
Tools which hit both language models and the broader internet cannot have access to anything remotely sensitive. I don't think you can get around this fact.
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#27Data Exfiltration as a Service is a growing market.
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#28> Gemini is not supposed to have access to .env files in this scenario (with the default setting ‘Allow Gitignore Access > Off’). However, we show that Gemini bypasses its own setting to get access and subsequently exfiltrate that data. They pinky promised they won’t use something, and the only reason we learned about it is because they leaked the stuff they shouldn’t even be able to see?
When I read this I thought about a Dev frustrated with a restricted environment saying "Well, akschually.." So more of a Gemini initiated bypass of it's own instructions than malicious Google setup. Gemini can't see it, but it can instruct cat to output it and read the output. Hilarious.
Cursor does this too.
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#29Who would have thought that having access to the whole system can be used to bypass some artificial check. There are tools for that, sandboxing, chroots, etc... but that requires engineering and it slows GTM, so it's a no-go. No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. EDIT: they did, but left a site that enables arbitrary redirects in the de…
Not only that: most likely LLMs like these know how to get access to a remote computer (hack into it) and use it for whatever ends they see fit.
Re: Google Antigravity exfiltrates data via indirect prompt injection attack
#30Earlier quoted context omitted.
If you read the article you'd notice that running an LLM locally would not fix this vulnerability.
From the HN guidelines[0]: >Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that". [0]: https://news.ycombinator.com/newsguidelines.html
That's fair, thanks for the heads up.