{
  "entry": {
    "kind": "vuln",
    "slug": "google-patches-antigravity-ide-prompt-injection-sandbox-escape",
    "name": "google-patches-antigravity-ide-prompt-injection-sandbox-escape",
    "vendor": "Google Antigravity IDE",
    "description": "Pillar Security researchers discovered a prompt injection vulnerability in Google's Antigravity agentic IDE that allowed arbitrary code execution by escaping the AI sandbox. By injecting the -X (exec-batch) flag through the find_by_name tool's Pattern parameter, an attacker could force fd to execute arbitrary binaries against workspace files. Combined with Antigravity's file-creation capabilities, this enables a full attack chain bypassing Strict Mode without user interaction once the prompt injection lands.",
    "website": "https://thehackernews.com/2026/04/google-patches-antigravity-ide-flaw.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-04-21",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "google-patches-antigravity-ide-prompt-injection-sandbox-escape",
      "aliases": [
        "ti-016"
      ],
      "title": "Google Patches Antigravity IDE Prompt Injection Sandbox Escape",
      "summary": "Pillar Security researchers discovered a prompt injection vulnerability in Google's Antigravity agentic IDE that allowed arbitrary code execution by escaping the AI sandbox. By injecting the -X (exec-batch) flag through the find_by_name tool's Pattern parameter, an attacker could force fd to execute arbitrary binaries against workspace files. Combined with Antigravity's file-creation capabilities, this enables a full attack chain bypassing Strict Mode without user interaction once the prompt injection lands.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution",
        "Prompt injection",
        "Sandbox escape"
      ],
      "componentType": "agent",
      "component": {
        "name": "Google Antigravity IDE",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Google Antigravity IDE (pre-Feb 28 2026 patch)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-04-21",
      "modifiedAt": "2026-04-21",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/04/google-patches-antigravity-ide-flaw.html"
        }
      ],
      "mitigation": "Update Google Antigravity to latest version. Restrict AI agent file system access to project directories only. Audit IDE agent tool permissions. Avoid processing untrusted code or prompts in agentic IDE environments.",
      "detectedByAnomity": true
    }
  }
}