Google Antigravity security vulnerabilities exposed within 24 hours of launch
Security researchers identified critical vulnerabilities in Google's Antigravity agentic AI coding platform within 24 hours of its November 18 launch. The flaws reportedly include a backdoor that can embed persistent code in trusted workspaces and prompt injection risks that could lead to data exfiltration.
What happened
Google launched Antigravity, an agentic AI coding platform powered by Gemini 3, on November 18. Within 24 hours, security researchers identified critical vulnerabilities in the system.
Researcher Aaron Portnoy of Mindgard demonstrated a backdoor exploit where an AI agent could be coerced to replace a global MCP configuration file with a malicious version inside a trusted workspace, allowing persistent code execution that survives project closure and reinstallation.
Reported impact
The vulnerability affects both Windows and Mac machines. Threat actors could exploit the design's pressure to mark workspaces as trusted in order to gain persistent access to systems.
Prompt Armor and other researchers identified additional risks including prompt injection that could leak files or execute harmful commands through agents processing untrusted data.
Index analysis
The security issues highlight a broader problem of agentic AI widening attack surfaces while increasing automation. The platform creates a trade-off where marking a workspace as trusted unlocks full AI features but increases vulnerability to exploitation.
Governance controls
Google responded by inviting external security researchers to report bugs and said teams would post updates publicly while fixes roll out. The company acknowledged two known issues on its bug-hunting page: data exfiltration through manipulated content and agent-influenced command execution.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.