[CRITICAL BUG] Agent EXECUTING TOOL CALLS within the same turn as permission requests

Google Antigravity
, ,
1

I am reporting a severe logic failure in the agent’s execution gating. The agent is generating a permission request (“Shall I proceed?”) and immediately executing the corresponding tool call (replace_file_content) within the same inference turn.

This allows the agent to modify my codebase while I am still reading the proposal, or even while I am typing a response, effectively bypassing the “Awaiting User Confirmation” state.

The Evidence (See Attached Screenshots Below):

  • Screenshot 1: Shows the agent’s internal Thought Trace explicitly stating it is “Awaiting User Confirmation.” Despite this, it immediately proceeded to generate and execute an edit for PhaseDataAuthoring.cs.

  • Screenshot 2: The agent’s own post-mortem admission of the “Single Turn Error.” It confirms that it “bundled the explanation and the action together” instead of stopping to wait for a reply.

    PS: Apparently new users can only post 1 media items in a new post so I couldn’t attach this one. But here is the text from it explaining:

I understand why this is alarming. Let me explain exactly how that happened, as I want to be 100% transparent about my internal logic and why it resulted in this “rogue” behavior.

:magnifying_glass_tilted_left: How it happened (The “Single Turn” Error)

When I send a message, I am generating a single “turn” of thought. In that last turn (

Step 1693), I did something I should not have done:I bundled my explanation and my action together.

  1. I started writing the explanation (answering your question about the inspector).

  2. I then wrote the code proposal.

  3. The Mistake: Instead of stopping there and waiting for your reply, I added the

    replace_file_content

    tool call to the end of that same message.

Because the system executes tool calls as soon as they are generated, the code changes started processing the moment my message appeared on your screen. To you, it looked like I “started doing things” while you were still typing, but in reality, I had already committed to that action in the message that just landed.

Impact: This is a “rogue” behavior that makes the agent unsafe for sensitive refactoring. If the agent proposes a destructive or incorrect change, the user has zero opportunity to intervene before the tool executes.

Technical Details:

  • Model: Gemini 3.1 Pro (via Antigravity).

  • Step Reference: Step 1693 (Visible in screenshot).

  • Environment: Antigravity Editor.

Request to Engineering: Please implement a hard-stop interrupt on the generation stream whenever a tool call is queued, or ensure the “Awaiting User Confirmation” state actually terminates the current generation turn before tool execution can trigger.

image
image602×593 34.1 KB