Google Antigravity exfiltrates data via indirect prompt injection attack

Post by verdverm » Tue, Nov 25, 2025, 9:43 PM UTC

verdverm wrote: post #87

cowpig wrote: post #26

Earlier quoted context omitted.

> No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. This is the only way. There has to be a firewall between a model and the internet. Tools which hit both language models and the broader internet cannot have access to anything remotely sensitive. I don't think you can get around this fact.

https://simonwillison.net/2025/Nov/2/new-prompt-injection-pa... Meta wrote a post that went through the various scenarios and called it the "Rule of Two" --- At a high level, the Agents Rule of Two states that until robustness research allows us to reliably detect and refuse prompt injection, agents must satisfy no more than two of the following three properties within a session to avoid the highest impact consequenc…

Post by simonw » Tue, Nov 25, 2025, 9:47 PM UTC

p1necone wrote: post #120

I feel like I'm going insane reading how people talk about "vulnerabilities" like this. If you give an llm access to sensitive data, user input and the ability to make arbitrary http calls it should be blindingly obvious that it's insecure. I wouldn't even call this a vulnerability, this is just intentionally exposing things. If I had to pinpoint the "real" vulnerability here, it would be this bit, but the way it's j…

Post by simonw » Tue, Nov 25, 2025, 9:49 PM UTC

keepamovin wrote: post #100

cowpig wrote: post #26

Earlier quoted context omitted.

> No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. This is the only way. There has to be a firewall between a model and the internet. Tools which hit both language models and the broader internet cannot have access to anything remotely sensitive. I don't think you can get around this fact.

Why not just do remote model isolation? Like remote browser isolation. Run your local model / agent on a little box that has access to the internet and also has your repository, but doesn't have anything else. Like BrowserBox. You interact with and drive the agent over a secure channel to your local machine, protected with this extra layer. Is the source-code the secret you are trying to protect? Okay, no internet fo…

Post by TacticalCoder » Tue, Nov 25, 2025, 9:50 PM UTC

p1necone wrote: post #120

I feel like I'm going insane reading how people talk about "vulnerabilities" like this. If you give an llm access to sensitive data, user input and the ability to make arbitrary http calls it should be blindingly obvious that it's insecure. I wouldn't even call this a vulnerability, this is just intentionally exposing things. If I had to pinpoint the "real" vulnerability here, it would be this bit, but the way it's j…

Post by lazide » Tue, Nov 25, 2025, 9:52 PM UTC

verdverm wrote: post #122

lazide wrote: post #105

Earlier quoted context omitted.

From the companies perspective, it’s still wrong.

their basing decisions (at least for my example) on risk profiles, not ethics, right and wrong are not how it's measured certainly some things are more "wrong" or objectionable like making bombs and dealing with users who are suicidal