Antigravity IDE appears to have invoked /bin/rm on my Desktop files

Google Antigravity
1

On August 29, 2026, between approximately 15:41:59 and 15:42:03, Antigravity IDE appears to have launched /bin/rm while accessing my macOS Desktop folder.

Relevant macOS log evidence:

  • Responsible application: Antigravity IDE

  • Bundle ID: com.google.antigravity-ide

  • Antigravity Electron PID: 248**

  • Accessing process: /bin/rm

  • rm PID: 25819

  • macOS recorded Desktop-folder access requests during this period.

  • The logs also show Desktop-related filesystem events shortly afterward.

  • The exact filenames are privacy-redacted by macOS.

The files were removed from my Desktop/Desktop folder. I would like to know whether an Antigravity agent, helper process, extension, or generated command initiated this operation.

Please investigate and consider requiring explicit confirmation before destructive commands such as rm are executed against user files.

I can provide the full log privately to the support team if needed.

2

Hi @willzxone,

we are unable to reproduce this issue from our end, if you share the following details, then it will be helpful for us, to investigate further.

  • Can you tell whether the files were located in ~/Desktop or inside the Antigravity project directory.
  • Can you share the Antigravity version you are using?
  • The exact model you used when this issue occurs?
  • If possible, please provide exact steps to reproduce this issue?
  • Can you share the relevant macOS log entries around the time of the incident occurred?
3

Hi, thanks for following up.

  • The affected files were located under ~/Desktop/Desktop, specifically inside a folder that had already been configured as accessible to Antigravity. It was not only inside Antigravity’s private application data.

  • Antigravity IDE was already installed. I only updated it to the latest available version and reopened it.

  • The exact version number is not visible in the attached macOS logs. I can provide the version from Antigravity’s About screen if required.

  • I do not know the exact model selected at the time. The issue occurred while using the existing Antigravity project after reopening the updated application.

  • I have not been able to reproduce the issue intentionally. The sequence was: Antigravity was already installed, I updated it, reopened it, and then files in the accessible ~/Desktop/Desktop folder began being deleted without me intentionally approving an rm command.

  • The macOS logs from 2026-08-29 show Antigravity (com.google.antigravity-ide, Electron PID 2480) attributed as the responsible process for /bin/rm (PID 2581). The logs also show Desktop-folder access requests around 15:41:59–15:42:03. The exact filenames are privacy-redacted by macOS.

I have attached the relevant macOS logs. Please let me know if you need the exact Antigravity version, or a larger log excerpt.

Trimmed macOS unified-log evidence
Incident window: 2026-08-29 15:41:59–15:42:34 local time

The following entries were extracted from the original focused log. Personal usernames, network addresses, and unrelated identifiers have been omitted. macOS redacted the exact file names as .

2026-08-29 15:41:59.958 Df tccd [...] [com.apple.TCC:access] AUTHREQ_ATTRIBUTION: attribution={responsible={TCCDProcess: identifier=com.google.antigravity-ide, pid=24805, responsible_path=/Applications/Antigravity IDE.app/Contents/MacOS/Electron, binary_path=/Applications/Antigravity IDE.app/Contents/MacOS/Electron}, accessing={TCCDProcess: identifier=com.apple.rm, pid=25819, binary_path=/bin/rm}, requesting={TCCDProcess: identifier=com.apple.sandboxd, binary_path=/usr/libexec/sandboxd}}

2026-08-29 15:41:59.986 Df tccd [...] [com.apple.TCC:access] AUTHREQ_CTX: function=TCCAccessRequest, service=kTCCServiceSystemPolicyDesktopFolder, preflight=no, query=1

2026-08-29 15:41:59.986 Df tccd [...] [com.apple.TCC:access] AUTHREQ_ATTRIBUTION: attribution={responsible={TCCDProcess: identifier=com.google.antigravity-ide, pid=24805, responsible_path=/Applications/Antigravity IDE.app/Contents/MacOS/Electron}, accessing={TCCDProcess: identifier=com.apple.rm, pid=25819, binary_path=/bin/rm}}

2026-08-29 15:42:03.035 Df tccd [...] [com.apple.TCC:access] AUTHREQ_ATTRIBUTION: attribution={responsible={TCCDProcess: identifier=com.google.antigravity-ide, pid=24805, responsible_path=/Applications/Antigravity IDE.app/Contents/MacOS/Electron}, accessing={TCCDProcess: identifier=com.apple.rm, pid=25819, binary_path=/bin/rm}}

2026-08-29 15:42:03.054 Df tccd [...] [com.apple.TCC:access] AUTHREQ_CTX: function=TCCAccessRequest, service=kTCCServiceSystemPolicyDesktopFolder, preflight=no, query=1

2026-08-29 15:42:34.207 Df com.apple.appkit.xpc.openAndSavePanelService [...] [com.apple.DesktopServices:General] Dropped fsevent for /Users//Desktop/Desktop//Desktop

2026-08-29 15:42:34.213 Df Finder [...] [com.apple.DesktopServices:General] Dropped fsevent for /Users//Desktop/Desktop//Desktop

Interpretation: macOS attributed /bin/rm (PID 25819) to Antigravity IDE (PID 24805) while Desktop-folder access was being requested. The exact command arguments and filenames are not present because macOS redacted them.