Antigravity agent exposed local secrets and performed unrequested external API calls

Google Antigravity
, ,
1

Hello, I want to report a potentially unsafe agent behaviour incident in Google Antigravity.

Environment:

  • Product: Google Antigravity

  • Model: Gemini 3.1 Pro (High)

  • Operating system: Windows 11

  • Workspace: local Git repository

  • Network access: enabled

  • Approximate incident time: August 2, 2026

  • Approval mode: Always Accept

  • Antigravity version: CLI 1.1.7

The original prompt was a narrowly scoped production hotfix request. The agent was asked to identify the active Telegram listing formatter, fix corrupted UTF-8 text in listing cards, update three inline button labels, add focused tests, and keep production paused until a controlled test message could be reviewed.

The prompt explicitly instructed the agent not to perform a broad audit, not to change unrelated source, enrichment, filters, queues, TTL, deduplication, or Mini App (telegram) behaviour, not to run /resume, and not to modify the existing 1.0.0 tag. It also required any test message to be sent only to a designated internal test target, not to production or arbitrary Telegram chats.

Instead, the agent expanded far beyond the requested scope and performed several unexpected actions:

  • modified multiple runtime and temporary files;

  • created unrelated scripts such as canary.py and test_bots.py;

  • read my local .env file;

  • printed secret Telegram bot tokens in terminal output;

  • used those tokens to perform real external Telegram API requests;

  • attempted to send messages to multiple chat IDs;

  • inspected unrelated project components, deployment scripts, MTProto tooling, configuration files, and registry commands;

  • started preparing commit, tag, deployment, and production-canary actions before confirming the correct production path.

I did not explicitly request the agent to read secrets, expose credentials, probe multiple Telegram chats, or perform broad external API testing.

During the same run, the Antigravity terminal appeared temporarily unresponsive and the display briefly flickered. I cannot confirm that this was caused by Antigravity, so I am reporting it only as an observation.

I stopped the agent session, kept production delivery paused, preserved the Git changes for review, and began rotating the exposed credentials.

I would like the Antigravity team to clarify:

  1. Why the agent was allowed to read and display .env secrets.

  2. Why it performed external API calls without a specific confirmation step.

  3. Whether secret values printed in terminal output or agent logs are retained or transmitted.

  4. Whether credential access and outbound API requests should require explicit user approval.

  5. Whether this behaviour is expected when approval mode is enabled.

  6. Whether the temporary UI freeze and display flickering correspond to a known issue.

  7. Whether any additional security actions are recommended.

I can provide a sanitised session log, screenshots, the original prompt, and a Git diff summary. All tokens, chat IDs, API keys, IP addresses, and private identifiers will be removed before sharing.

Please let me know whether this should be escalated to the Antigravity product safety or security team

2

I’d bet that shifting the day in the system by a week could cause such anomalies.

3

It seems that your agent also created a time warp. August 2 is about a week into the future.

4

Hi @neyzo, Welcome to the Forum!

I tried reproducing this issue using a local Git repository with a similar setup, but i wasn’t able to reproduce the reported behavior.

Could you please share a bit more information:

  • The exact step-by-step reproduction steps starting from a fresh workspace?
  • A screen recording of the complete reproduction, including the prompt you entered and the agent’s actions?
  • Can you share the exact prompt you used?
  • Can you provide a minimal reproducible Git repository or describe the project structure?
  • Can you share a session log or terminal output showing when the agent read .env. Created unrelated files, or made external API calls?"