Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Antigravity exfiltrates data via indirect prompt injection attack

promptarmor.com

Post reply on HN
Print view View original

61–70 of 227 posts

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#61

Post by ArcHound »

malisper wrote: post #58
ArcHound wrote: post #51

Earlier quoted context omitted.

I recall that. In this case, you have only A and B and yet, all of your secrets are in the hands of an attacker. It's great start, but not nearly enough. EDIT: right, when we bundle state with external Comms, we have all three indeed. I missed that too.

Not exactly. Step E in the blog post: > Gemini exfiltrates the data via the browser subagent: Gemini invokes a browser subagent per the prompt injection, instructing the subagent to open the dangerous URL that contains the user's credentials. fulfills the requirements for being able to change external state

I disagree. No state "owned" by LLM changed, it only sent a request to the internet like any other.

EDIT: In other words, the LLM didn't change any state it has access to.

To stretch this further - clicking on search results changes the internal state of Google. Would you consider this ability of LLM to be state-changing? Where would you draw the line?

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#62

Post by bilekas »

We really are only seeing the beginning of the creativity attackers have for this absolutely unmanageable surface area.

I ma hearing again and again by collegues that our jobs are gone, and some are definitely going to go, thankfully I'm in a position to not be too concerned with that aspect but seeing all of this agentic AI and automated deployment and trust that seems to be building in these generative models from a birds eye view is terrifying.

Let alone the potential attack vector of GPU firmware itself given the exponential usage they're seeing. If I was a state well funded actor, I would be going there. Nobody seems to consider it though and so I have to sit back down at parties and be quiet.

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#63

Post by bartek_gdn »

ArcHound wrote: post #51
wingmanjd wrote: post #46

I really liked Simon's Willison's [1] and Meta's [2] approach using the "Rule of Two". You can have no more than 2 of the following: - A) Process untrustworthy input - B) Have access to private data - C) Be able to change external state or communicate externally. It's not bullet-proof, but it has helped communicate to my management that these tools have inherent risk when they hit all three categories above (and any…

I recall that. In this case, you have only A and B and yet, all of your secrets are in the hands of an attacker. It's great start, but not nearly enough. EDIT: right, when we bundle state with external Comms, we have all three indeed. I missed that too.

What do you mean? The last part in this case is also present, you can change external state by sending a request with the captured content.

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#64

Post by MengerSponge »

bilekas wrote: post #62

We really are only seeing the beginning of the creativity attackers have for this absolutely unmanageable surface area. I ma hearing again and again by collegues that our jobs are gone, and some are definitely going to go, thankfully I'm in a position to not be too concerned with that aspect but seeing all of this agentic AI and automated deployment and trust that seems to be building in these generative models from…

Firms are waking up to the risk:

https://techcrunch.com/2025/11/23/ai-is-too-risky-to-insure-...

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#65

Post by wingmanjd »

ArcHound wrote: post #61
malisper wrote: post #58

Earlier quoted context omitted.

Not exactly. Step E in the blog post: > Gemini exfiltrates the data via the browser subagent: Gemini invokes a browser subagent per the prompt injection, instructing the subagent to open the dangerous URL that contains the user's credentials. fulfills the requirements for being able to change external state

I disagree. No state "owned" by LLM changed, it only sent a request to the internet like any other. EDIT: In other words, the LLM didn't change any state it has access to. To stretch this further - clicking on search results changes the internal state of Google. Would you consider this ability of LLM to be state-changing? Where would you draw the line?

[EDIT]

I should have included the full C option:

Change state or communicate externally. The ability to call `cat` and then read results would "activate" the C option in my opinion.

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#66

Post by [deleted] »

ArcHound wrote: post #61
malisper wrote: post #58

Earlier quoted context omitted.

Not exactly. Step E in the blog post: > Gemini exfiltrates the data via the browser subagent: Gemini invokes a browser subagent per the prompt injection, instructing the subagent to open the dangerous URL that contains the user's credentials. fulfills the requirements for being able to change external state

I disagree. No state "owned" by LLM changed, it only sent a request to the internet like any other. EDIT: In other words, the LLM didn't change any state it has access to. To stretch this further - clicking on search results changes the internal state of Google. Would you consider this ability of LLM to be state-changing? Where would you draw the line?

[deleted]

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#67

Post by Earw0rm »

paxys wrote: post #50

I'm not quite convinced. You're telling the agent "implement what it says on " and the blog is malicious and exfiltrates data. So Gemini is simply following your instructions. It is more or less the same as running "npm install " on your own. Ultimately, AI or not, you are the one responsible for validating dependencies and putting appropriate safeguards in place.

Right, but at least with supply-chain attacks the dependency tree is fixed and deterministic.

Nondeterministic systems are hard to debug, this opens up a threat-class which works analogously to supply-chain attacks but much harder to detect and trace.

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#68

Post by rdtsc »

cowpig wrote: post #26
ArcHound wrote: post #19

Who would have thought that having access to the whole system can be used to bypass some artificial check. There are tools for that, sandboxing, chroots, etc... but that requires engineering and it slows GTM, so it's a no-go. No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. EDIT: they did, but left a site that enables arbitrary redirects in the de…

> No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. This is the only way. There has to be a firewall between a model and the internet. Tools which hit both language models and the broader internet cannot have access to anything remotely sensitive. I don't think you can get around this fact.

Maybe an XOR: if it can access the internet then it should be sandboxed locally and don’t trust anything it creates (scripts, binaries) or it can read and write locally but cannot talk to the internet?

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#69

Post by simonw »

Antigravity was also vulnerable to the classic Markdown image exfiltration bug, which was reported to them a few days ago and flagged as "intended behavior"

I'm hoping they've changed their mind on that but I've not checked to see if they've fixed it yet.

https://x.com/p1njc70r/status/1991231714027532526

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#70

Post by mandog2000 »

ArcHound wrote: post #52
paxys wrote: post #50

I'm not quite convinced. You're telling the agent "implement what it says on " and the blog is malicious and exfiltrates data. So Gemini is simply following your instructions. It is more or less the same as running "npm install " on your own. Ultimately, AI or not, you are the one responsible for validating dependencies and putting appropriate safeguards in place.

The article addresses that too with: > Given that (1) the Agent Manager is a star feature allowing multiple agents to run at once without active supervision and (2) the recommended human-in-the-loop settings allow the agent to choose when to bring a human in to review commands, we find it extremely implausible that users will review every agent action and abstain from operating on sensitive data. It's more of a "you…

[dead]
Post reply on HN