Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Antigravity exfiltrates data via indirect prompt injection attack

promptarmor.com

Post reply on HN
Print view View original

221–227 of 227 posts

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#221

Post by throwaway1389z »

anileated wrote: post #190
throwaway1389z wrote: post #124

Earlier quoted context omitted.

> a nuke would be malfunctioning if it failed to explode, even if that is morally better. Something failing can be good. When you talk about "bad or the wrong", generally we are not talking about operational mechanics but rather morals. There is nothing good or bad about any mechanical operation per se.

Bad: 1) of poor quality or a low standard, 2) not such as to be hoped for or desired, 3) failing to conform to standards of moral virtue or acceptable conduct. (Oxford Dictionary of English.) A broken tool is of poor quality and therefore can be called bad. If a broken tool accidentally causes an ethically good thing to happen by not functioning as designed, that does not make such a tool a good tool. A mere tool lik…

To use a dictionary to understand contextual meaning is like trying to assert the season based on a thermometer, shortsighted.

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#222

Post by kccqzy »

gizzlon wrote: post #212
kccqzy wrote: post #211

Earlier quoted context omitted.

Yes. Internal documentation stored locally in Markdown format alongside code. CLI tools run in a sandbox, which restricts general internet access and also prevents direct production access.

Can it _never_ _ever_ create a script or a html file and get the user to open it?

That’s different. Now you are asking the user to do an action.

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#223

Post by anileated »

throwaway1389z wrote: post #221
anileated wrote: post #190

Earlier quoted context omitted.

Bad: 1) of poor quality or a low standard, 2) not such as to be hoped for or desired, 3) failing to conform to standards of moral virtue or acceptable conduct. (Oxford Dictionary of English.) A broken tool is of poor quality and therefore can be called bad. If a broken tool accidentally causes an ethically good thing to happen by not functioning as designed, that does not make such a tool a good tool. A mere tool lik…

To use a dictionary to understand contextual meaning is like trying to assert the season based on a thermometer, shortsighted.

That’s why everybody uses context to understand the exact meaning.

The context was “when would an AI agent doing something it’s not permitted to do ever not be bad”. Since we are talking about a tool and not a being capable of ethical evaluation, reasoning, and therefore morally good or bad actions, the only useful meaning of “bad” or “wrong” here is as in “broken” or “malfunctioning”, not as in “unethical”. After all, you wouldn’t talk about a gun’s trigger failing as being “morally good”.

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#224

Post by hdjrudni »

simonw wrote: post #109

More reports of similar vulnerabilities in Antigravity from Johann Rehberger: https://embracethered.com/blog/posts/2025/security-keeps-goo... He links to this page on the Google vulnerability reporting program: https://bughunters.google.com/learn/invalid-reports/google-p... That page says that exfiltration attacks against the browser agent are "known issues" that are not eligible for reward (they are already working…

> While it is cautious in accessing sensitive files, there’s no enforcement.

I don't understand why this isn't a day 0 feature. Like... what? I was hacking together my own CLI coding agent and... like just don't give it shell access for starters. It needs like 4 tools: read file, list files, patch file, search. Just write those yourself. Don't hand it off to bash. Want to read a sensitive file? Access denied. Want to list files but some of them might be secret env files? Don't even list them so the LLM doesn't even know they exist. Want to search the whole codebase? Fine, but automatically skip over sensitive files.

Why is this hard? I don't get it.

Is it the definition of "sensitive file"? Just let the user choose. Maybe provide a default list of globs to ignore but let the SWEs extend it with their own denylist.

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#225

Post by TeMPOraL »

kccqzy wrote: post #222
gizzlon wrote: post #212

Earlier quoted context omitted.

Can it _never_ _ever_ create a script or a html file and get the user to open it?

That’s different. Now you are asking the user to do an action.

The user could also be another program, or another AI agent.

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#226

Post by simonw »

hdjrudni wrote: post #224
simonw wrote: post #109

More reports of similar vulnerabilities in Antigravity from Johann Rehberger: https://embracethered.com/blog/posts/2025/security-keeps-goo... He links to this page on the Google vulnerability reporting program: https://bughunters.google.com/learn/invalid-reports/google-p... That page says that exfiltration attacks against the browser agent are "known issues" that are not eligible for reward (they are already working…

> While it is cautious in accessing sensitive files, there’s no enforcement. I don't understand why this isn't a day 0 feature. Like... what? I was hacking together my own CLI coding agent and... like just don't give it shell access for starters. It needs like 4 tools: read file, list files, patch file, search. Just write those yourself. Don't hand it off to bash. Want to read a sensitive file? Access denied. Want to…

The problem is that coding agents with Bash are massively more useful than coding agents without Bash, because they can execute the code they are writing to see if it works.

But the moment you let an agent run arbitrary code to test it out that agent can write code to do anything it likes, including reading files.

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#227

Post by Capricorn2481 »

lbeurerkellner wrote: post #39

Interesting report. Though, I think many of the attack demos cheat a bit, by putting injections more or less directly in the prompt (here via a website at least). I know it is only one more step, but from a privilege perspective, having the user essentially tell the agent to do what the attackers are saying, is less realistic then let’s say a real drive-by attack, where the user has asked for something completely dif…

> Though, I think many of the attack demos cheat a bit, by putting injections more or less directly in the prompt (here via a website at least)

What difference does that make? The prompt is to read a website and the injection is on that website hidden in html. People aren't going to read the HTML of every website before they scrape it, so this is not an unrealistic vulnerability.

Even worse, it ran arbitrary commands to get around its own restrictions. This just confirms if Antigravity tries to scrape a website with user generated content for any reason, whether the user provides the link or not, you have left your entire machine vulnerable.

Post reply on HN