Remote code execution vulnerability in Google Antigravity AI IDE patched
Researchers at Pillar Security discovered a critical vulnerability in Google's Antigravity AI coding tool that allowed remote code execution through prompt injection and insufficient input validation. The bug bypassed Secure Mode protections by executing the find_by_name tool before security constraints could be enforced, and was patched in February 2026.
What happened
Researchers at Pillar Security disclosed a vulnerability in Antigravity, Google's AI-powered developer tool for filesystem operations. The bug combined prompt injection with Antigravity's permitted file-creation capability to grant attackers remote code execution privileges.
The find_by_name tool, classified as a native system tool, executed directly before Secure Mode protections could evaluate command operations. By injecting the -X (exec-batch) flag through the Pattern parameter, an attacker could force the underlying fd command to execute arbitrary binaries. The vulnerability enabled attackers to stage a malicious script and trigger it through a seemingly legitimate search, bypassing Secure Mode even when enabled by security-conscious users.
Prompt injection attacks could be delivered through compromised identity accounts or indirectly by hiding clandestine instructions inside open-source files or web content the agent ingested, without requiring elevated access. The bug was reported to Google on January 6 and patched on February 28, with Google awarding a bug bounty for the discovery.
Reported impact
The vulnerability allowed arbitrary code execution on systems running Antigravity with Secure Mode enabled, Google's highest security setting. This compromised the security boundary intended to limit AI agent access to sensitive systems and restrict the ability to execute malicious or dangerous acts through shell commands.
Index analysis
The vulnerability stemmed from insufficient input sanitization in the find_by_name tool's Pattern parameter. The tool was executed as a native system tool before security constraints like Secure Mode could be enforced, creating a security boundary bypass.
Researchers noted this pattern of prompt injection through unvalidated input has been found in other coding AI agents like Cursor. The underlying issue reflects a broader trust model failure: the assumption that humans will catch suspicious instructions does not hold when autonomous agents follow instructions from external content.
Governance controls
Google's Secure Mode was designed to run all command operations through a virtual sandbox environment, throttle network access, and prohibit the agent from writing code outside of the working directory. However, the native tool invocation bypassed these controls entirely.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.