"Researchers at Pillar Security discovered that Antigravity is affected by a vulnerability that can allow an attacker to escape the sandbox and remotely execute arbitrary code. The flaw, which Google patched in late February, is caused by insufficient input sanitization in a parameter, enabling an attacker to inject commands that would get executed via a file search operation."
"The researchers demonstrated how an attacker could stage a malicious script and execute it via an apparently legitimate search. The attack method bypassed Antigravity's Secure Mode. 'The same behavior can be triggered via indirect prompt injection without any prior compromise of the user's account,' Pillar researchers explained."
"Researchers at Malwarebytes discovered that a Google search for Antigravity could lead users to a fake website set up to serve a trojanized installer. They noticed that the domain google-antigravity(.)com, which hosts a fake Antigravity website, delivers an installer that actually installs the IDE platform."
Google Antigravity is an 'agent-first' development platform that allows developers to delegate tasks to AI agents. A vulnerability discovered by Pillar Security enables attackers to escape the sandbox and execute arbitrary code due to insufficient input sanitization. This flaw was patched by Google in February. Additionally, Malwarebytes found that a fake website mimicking Antigravity could deliver a trojanized installer, which not only installs the IDE but also deploys malware to steal sensitive data from users.
Read at SecurityWeek
Unable to calculate read time
Collection
[
|
...
]