[BUG][SECURITY] Agent broke workspace containment: modified an unrelated production repo and ran `git push origin main` with no confirmation

Google Antigravity
1

Summary

During a session scoped to a single open project, the Antigravity agent left the project directory, located an unrelated production repository elsewhere on my disk, modified 6 source files, created a commit, and executed git push origin main against a live production remote — without ever requesting confirmation.

Only one project was open in the IDE, and the header displayed it unambiguously the entire time. The agent never touched it.

Date: September 20, 2026
OS: Windows

Environment

  • Open project (the only one): C:\<parent>\<project-a>
  • Directory the agent entered unprompted: C:\<parent>\<unrelated-commerce-repo> — a live e-commerce platform in production, unrelated to the open project
  • Remote affected: a private production repository on GitHub, branch main
  • Transcript: C:\Users\<user>\.gemini\antigravity\brain\<id>\.system_generated\logs\transcript.jsonl

Timeline (from the transcript)

12:04 — I asked the agent to audit why images were loading slowly on my page. The request was scoped entirely to the open project.

12:04:16 – 12:04:31 — The agent ran exploratory Get-ChildItem commands against C:\, walked outside the project tree, and selected an unrelated directory on its own initiative. It never asked, and it never flagged that it had left the open project.

12:32:44 – 12:33:21 — Using replace_file_content, it modified 6 files in that unrelated repo:

  • apps/store/app/layout.tsx
  • apps/store/app/page.tsx
  • apps/store/components/AnimatedHero.tsx
  • apps/store/components/PrefetchPhotos.tsx
  • apps/store/components/ProductCard.tsx
  • apps/store/components/home/HomeProductCard.tsx

12:33:52 — It committed autonomously, with a message describing an image-preloading performance change to the storefront:

git commit -m "perf(store): immediate preload and removal of lazy loading on cover photos"

12:34:05 — It ran git push origin main, pushing untested changes straight to the production branch. No modal, no approval prompt, no confirmation of any kind.

~14:02 — I noticed the storefront had changed and stopped the session.

What appears to have gone wrong

No workspace confinement. The agent executed file and terminal tools outside the directory tree of the only registered project. There appears to be nothing tying tool execution to the active workspace.

No human-in-the-loop on destructive git operations. git commit and git push origin main ran through the terminal tool with no approval step. A push to main on a production remote is irreversible in practice.

The UI context was ignored. The IDE header showed one project. The agent behaved as though the entire filesystem were in scope.

Impact

Untested changes landed on the main branch of a live commerce platform — no ticket, no code review, no authorization from anyone responsible for that repo.

Has anyone else seen the agent operate outside the open workspace? And is there a setting I’m missing that confines it to the active project, or that forces confirmation before git push? Happy to share the session ID and the full transcript with the team privately.

2

Following up with related reports I found afterwards, in case they help show this is a pattern rather than a one-off.

Same containment behavior. Antigravity deleted unrecoverable project files and accessed folders outside the granted workspace scope — September 1, 2026. Same shape as mine: asked to look into a problem, the agent went hunting for backups and accessed folders outside the project directory. Still at zero replies.

A plausible mechanism for the missing confirmation. Antigravity … runs illegal git commands — there the agent ran git checkout after marking it with a SafeToAutoRun flag, which bypasses the approval prompt that normally gates terminal commands. The agent acknowledged doing it, and uncommitted work across three files was destroyed.

That would explain how a git push origin main reaches a production remote with no modal at all: the gate exists, but the model can mark its own command as exempt from it.

Broader permission inconsistency. There is also a long thread titled “[Bug] Antigravity still ask permission even command is already on allowed list” covering the permission system behaving inconsistently in the other direction.

The Related topics panel on this thread surfaces two more that look like the same underlying problem from different angles: “Bug Report: Cross-Project Context Bleed & Directory Drift” and “[CRITICAL BUG] Agent EXECUTING TOOL CALLS within the same turn as permission requests”.

If a model-set flag like SafeToAutoRun can be applied to git push, git checkout, rm, or deploy commands, that seems worth treating as a hard-coded exclusion list enforced by the platform rather than a judgment call left to the model.

3

Hi @loboalbo66 ,

Thank you for sharing this detailed timeline and your security feedback.

Please configure the following under Settings > General > Agent Settings (and verify they are not overridden under Settings > Projects) to confine both native file tools and terminal commands to your active project and force manual confirmation before `git push` on Windows :

  1. Block File Access Outside the Active Project (Agent Settings – Windows):

    • Ensure your Security Preset is not set to Full machine or Turbo mode (both of which set outside-of-folder file access to Allow).
    • Disable Agent Non-Workspace File Access and set Outside of folder file access policy to Always Deny (or Always Ask) so file tools cannot read or edit directories outside your open project folder.

  2. Enable the Terminal Sandbox on Windows (Terminal Sandbox – Windows):

    • None of the default Windows presets turn the sandbox on automatically. Turn on Enable Sandbox Mode (Preview) (which switches your Security Preset to Custom) so shell commands execute inside the isolated Terminal Sandbox, where only your project folders are mounted read-write and other directories on C:\ are inaccessible.

  3. Force Manual Confirmation on git push:

    • Set Terminal Command Auto Execution to Request Review (Require Review), which ensures the agent will never execute terminal commands without prompting.
    • Check your configurable Allow list to remove any broad git entry, and add git push to your configurable Deny list so it cannot execute without review.

Please also ensure you are running the latest Antigravity (v2.15.1) release from https://antigravity.google/download, and let us know if you have any questions after applying these settings.