GoKawiilGoogle has fixed a critical flaw in its agentic integrated developer environment (IDE) Antigravity that led to sandbox escape and remote code execution (RCE) after researchers created a proof of concept (PoC) prompt injection attack exploiting it.
Prompt injection issues are becoming a major thorn in the side of artificial intelligence (AI) tools, although in this case the vulnerability seems to be more of a common problem with IDEs in general rather than an AI-specific one. IDEs are a package of basic tools and capabilities that developers need to program, edit, and test software code; Antigravity is an agentic IDE that provides developers with native tools for filesystem operations.
Researchers at Pillar Security uncovered a critical flaw in Antigravity's tool-execution model that allows attackers to escalate a seemingly benign prompt injection into full system compromise, according to a blog post published this week. The issue centers on how the IDE handles internal tool calls — specifically, a file-search capability that executes before security controls are enforced.
Related:Every Old Vulnerability Is Now an AI Vulnerability
Specifically, the flaw affects the find_by_name tool's Pattern parameter, allowing attackers to exploit insufficient input sanitization and for injection of command-line flags into the underlying fd utility, according to the post. This basically converts a file search operation into arbitrary code execution, according to the post.
'Full Attack Chain'
Ultimately, combined with Antigravity's ability to create files as a permitted action, the result is "a full attack chain: stage a malicious script, then trigger it through a seemingly legitimate search, all without additional user interaction once the prompt injection lands," Pillar Security's Dan Lisichkin wrote in the post. The vulnerability is dangerous because it bypasses Antigravity's Secure Mode, the product's most restrictive security configuration.
"Secure Mode is designed to restrict network access, prevent out-of-workspace writes, and ensure all command operations run strictly under a sandbox context," Lisichkin wrote. "None of these controls prevent exploitation, because the find_by_name tool call fires before any of these restrictions are evaluated."
That means that the agent treats the call as a native tool invocation, not a shell command, so it never reaches the security boundary that Secure Mode enforces, he said. "This means an attacker achieves arbitrary code execution under the exact configuration a security-conscious user would rely on to prevent it.," Lisichkin wrote.
Related:NIST Revamps CVE Framework to Focus on High-Impact Vulnerabilities
... continue reading