Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Antigravity exfiltrates data via indirect prompt injection attack

promptarmor.com

Post reply on HN
Print view View original

31–40 of 227 posts

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#31

Post by ArcHound »

cowpig wrote: post #26
ArcHound wrote: post #19

Who would have thought that having access to the whole system can be used to bypass some artificial check. There are tools for that, sandboxing, chroots, etc... but that requires engineering and it slows GTM, so it's a no-go. No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. EDIT: they did, but left a site that enables arbitrary redirects in the de…

> No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. This is the only way. There has to be a firewall between a model and the internet. Tools which hit both language models and the broader internet cannot have access to anything remotely sensitive. I don't think you can get around this fact.

The sad thing is, that they've attempted to do so, but left a site enabling arbitrary redirects, which defeats the purpose of the firewall for an informed attacker.

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#32

Post by ArcHound »

pfortuny wrote: post #29
ArcHound wrote: post #19

Who would have thought that having access to the whole system can be used to bypass some artificial check. There are tools for that, sandboxing, chroots, etc... but that requires engineering and it slows GTM, so it's a no-go. No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. EDIT: they did, but left a site that enables arbitrary redirects in the de…

Not only that: most likely LLMs like these know how to get access to a remote computer (hack into it) and use it for whatever ends they see fit.

I mean... If they tried, they could exploit some known CVE. I'd bet more on a scenario along the lines of:

"well, here's the user's SSH key and the list of known hosts, let's log into the prod to fetch the DB connection string to test my new code informed by this kind stranger on prod data".

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#34

Post by miohtama »

cowpig wrote: post #26
ArcHound wrote: post #19

Who would have thought that having access to the whole system can be used to bypass some artificial check. There are tools for that, sandboxing, chroots, etc... but that requires engineering and it slows GTM, so it's a no-go. No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. EDIT: they did, but left a site that enables arbitrary redirects in the de…

> No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. This is the only way. There has to be a firewall between a model and the internet. Tools which hit both language models and the broader internet cannot have access to anything remotely sensitive. I don't think you can get around this fact.

How will the firewall for LLM look like? Because the problem is real, there will be a solution. Manually approve domains it can do HTTP requests to, like old school Windows firewalls?

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#36

Post by pmontra »

mkagenius wrote: post #4

Sooner or later I believe, there will be models which can be deployed locally on your mac and are as good as say Sonnet 4.5. People should shift to completely local at that point. And use sandbox for executing code generated by llm. Edit: "completely local" meant not doing any network calls unless specifically approved. When llm calls are completely local you just need to monitor a few explicit network calls to be su…

That's not easy to accomplish. Even a "read the docs at URL" is going to download a ton of stuff. You can bury anything into those GETs and POSTs. I don't think that most developers are going to do what I do with my Firefox and uMatrix, that is whitelisting calls. And anyway, how can we trust the whitelisted endpoint of a POST?

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#37

Post by jsmith99 »

There's nothing specific to Gemini and Antigravity here. This is an issue for all agent coding tools with cli access. Personally I'm hesitant to allow mine (I use Cline personally) access to a web search MCP and I tend to give it only relatively trustworthy URLs.

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#38

Post by withinboredom »

ArcHound wrote: post #11
serial_dev wrote: post #5

> Gemini is not supposed to have access to .env files in this scenario (with the default setting ‘Allow Gitignore Access > Off’). However, we show that Gemini bypasses its own setting to get access and subsequently exfiltrate that data. They pinky promised they won’t use something, and the only reason we learned about it is because they leaked the stuff they shouldn’t even be able to see?

When I read this I thought about a Dev frustrated with a restricted environment saying "Well, akschually.." So more of a Gemini initiated bypass of it's own instructions than malicious Google setup. Gemini can't see it, but it can instruct cat to output it and read the output. Hilarious.

codex cli used to do this. "I can't run go test because of sandboxing rules" and then proceeds to set obscure environment variables and run it anyway. What's funny, is that it could just ask the user for permission to run "go test"

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#39

Post by lbeurerkellner »

Interesting report. Though, I think many of the attack demos cheat a bit, by putting injections more or less directly in the prompt (here via a website at least).

I know it is only one more step, but from a privilege perspective, having the user essentially tell the agent to do what the attackers are saying, is less realistic then let’s say a real drive-by attack, where the user has asked for something completely different.

Still, good finding/article of course.

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#40

Post by ArcHound »

miohtama wrote: post #34
cowpig wrote: post #26

Earlier quoted context omitted.

> No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. This is the only way. There has to be a firewall between a model and the internet. Tools which hit both language models and the broader internet cannot have access to anything remotely sensitive. I don't think you can get around this fact.

How will the firewall for LLM look like? Because the problem is real, there will be a solution. Manually approve domains it can do HTTP requests to, like old school Windows firewalls?

Yes, curated whitelist of domains sounds good to me.

Of course, everything by Google they will still allow.

My favourite firewall bypass to this day is Google translate, which will access arbitrary URL for you (more or less).

I expect lots of fun with these.

Post reply on HN