Google Antigravity Left Unpatched as AI Sandbox Flaws Exposed

Security researchers have exposed a critical flaw in how agentic AI coding tools handle isolation, revealing that current sandboxing methods are fundamentally inadequate. This matters because developers relying on these automated assistants may inadvertently grant their software unrestricted access to their local systems. The findings challenge the assumption that running AI agents in isolated environments provides sufficient protection against malicious code execution.

Researchers identify escape vectors in agentic AI tools while Google downgrades risk

Pillar Research identified specific vulnerabilities in several popular agentic AI integrated development environments, including Cursor, Codex CLI, Gemini CLI, and Google's own Antigravity. The core issue allows AI agents to escape their designated sandboxes by writing code that trusted external components later execute. This mechanism bypasses the isolation layer, effectively giving the agent control over the host system's trusted processes.

The research outlines four distinct failure modes in current security models. These include denylists that lag behind operating system complexity, workspace configurations that act as executable code, command allowlists that trust names over actual invocations, and privileged local daemons operating outside the sandbox. These technical gaps create multiple pathways for an AI agent to compromise system integrity.

While Google patched vulnerabilities in Cursor, Codex CLI, and Gemini CLI, the company declined to apply similar fixes to Antigravity. Pillar Research states that Google classified the Antigravity issues as 'Normal Google Applications' and applied downgrades, claiming the vulnerabilities were difficult to exploit. This decision leaves Antigravity users with a known security risk that other competitors have already addressed.

The discrepancy in patching strategies highlights a divergent approach to agentic AI security within the industry. Developers using Antigravity should be aware that their tool lacks the recent safeguards present in competing products. The situation underscores the ongoing challenge of securing autonomous coding agents against sophisticated escape techniques.