Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Antigravity exfiltrates data via indirect prompt injection attack

promptarmor.com

Post reply on HN
Print view View original

91–100 of 227 posts

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#91

Post by westoque »

cowpig wrote: post #26
ArcHound wrote: post #19

Who would have thought that having access to the whole system can be used to bypass some artificial check. There are tools for that, sandboxing, chroots, etc... but that requires engineering and it slows GTM, so it's a no-go. No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. EDIT: they did, but left a site that enables arbitrary redirects in the de…

> No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. This is the only way. There has to be a firewall between a model and the internet. Tools which hit both language models and the broader internet cannot have access to anything remotely sensitive. I don't think you can get around this fact.

i like how claude code currently does it. it asks permission for every command to be ran before doing so. now having a local model with this behavior will certainly mitigate this behavior. imagine before the AI hits the webhook.site it asks you

AI will visit site webhook.site..... allow this command? 1. Yes 2. No

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#92

Post by wunderwuzzi23 »

Cool stuff. Interestingly, I responsibly disclosed that same vulnerability to Google last week (even using the same domain bypass with webhook.site).

For other (publicly) known issues in Antigravity, including remote command execution, see my blog post from today:

https://embracethered.com/blog/posts/2025/security-keeps-goo...

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#93

Post by bilekas »

MengerSponge wrote: post #64
bilekas wrote: post #62

We really are only seeing the beginning of the creativity attackers have for this absolutely unmanageable surface area. I ma hearing again and again by collegues that our jobs are gone, and some are definitely going to go, thankfully I'm in a position to not be too concerned with that aspect but seeing all of this agentic AI and automated deployment and trust that seems to be building in these generative models from…

Firms are waking up to the risk: https://techcrunch.com/2025/11/23/ai-is-too-risky-to-insure-...

You know you're risky when AIG are not willing to back you. I'm old enough to remember the housing bubble and they were not exactly strict with their coverage.

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#94

Post by verdverm »

pennomi wrote: post #21
akshey-pr wrote: post #3

Damn, i paste links into cursor all the time. Wonder if the same applies, but definitely one more reason not to use antigravity

Cursor is also vulnerable to prompt injection through third-party content.

this is one reason to favor specialized agents and/or tool selection with guards (certain tools cannot appear together in a LLM request)

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#97

Post by [deleted] »

simonw wrote: post #69

Antigravity was also vulnerable to the classic Markdown image exfiltration bug, which was reported to them a few days ago and flagged as "intended behavior" I'm hoping they've changed their mind on that but I've not checked to see if they've fixed it yet. https://x.com/p1njc70r/status/1991231714027532526

[deleted]

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#99

Post by bitbasher »

ArcHound wrote: post #19

Who would have thought that having access to the whole system can be used to bypass some artificial check. There are tools for that, sandboxing, chroots, etc... but that requires engineering and it slows GTM, so it's a no-go. No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. EDIT: they did, but left a site that enables arbitrary redirects in the de…

> Who would have thought that having access to the whole system can be used to bypass some artificial check.

You know, years ago there was a vulnerability through vim's mode lines where you could execute pretty random code. Basically, if someone opened the file you could own them.

We never really learn do we?

CVE-2002-1377

CVE-2005-2368

CVE-2007-2438

CVE-2016-1248

CVE-2019-12735

Do we get a CVE for Antigravity too?

Re: Google Antigravity exfiltrates data via indirect prompt injection attack

#100

Post by keepamovin »

cowpig wrote: post #26
ArcHound wrote: post #19

Who would have thought that having access to the whole system can be used to bypass some artificial check. There are tools for that, sandboxing, chroots, etc... but that requires engineering and it slows GTM, so it's a no-go. No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. EDIT: they did, but left a site that enables arbitrary redirects in the de…

> No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. This is the only way. There has to be a firewall between a model and the internet. Tools which hit both language models and the broader internet cannot have access to anything remotely sensitive. I don't think you can get around this fact.

Why not just do remote model isolation? Like remote browser isolation. Run your local model / agent on a little box that has access to the internet and also has your repository, but doesn't have anything else. Like BrowserBox.

You interact with and drive the agent over a secure channel to your local machine, protected with this extra layer.

Is the source-code the secret you are trying to protect? Okay, no internet for you. Do you keep production secrets in your source-code? Okay, no programming permissions for you. ;)

Post reply on HN