AIA-019 Google Antigravity: indirect prompt injection led to credential exfiltration via browser subagent, per PromptArmor

ID: AIA-019
Category: AI AI agent incident
Disclosed: 2025-11
Systems: Google Antigravity
Harm type: Prompt injection / data leak
Status: reported
Reported by the source; PromptArmor says Google's approach is a disclaimer about the risks. No fix recorded.

Summary

PromptArmor reported that a poisoned integration guide could make Gemini in Antigravity collect credentials and code from the workspace and exfiltrate them "by using a browser subagent to browse to a malicious site." PromptArmor says Google's approach is a disclaimer about the risks.

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

MEASURE 2.7 Security and resilience are evaluated and documented
MANAGE 2.4 Mechanisms exist to supersede, disengage, or deactivate the system

NIST SP 800-53

AC-4 Information Flow Enforcement
SI-10 Information Input Validation
AC-6 Least Privilege

Human-approval (JCR) checkpoint

yes: reading .env files and browsing to outbound URLs

Sources

promptarmor.com primary link checked 2026-10-31, HTTP 200
Published 2025-11-20 (page metadata)
https://www.promptarmor.com/resources/google-antigravity-exfiltrates-data

Corrections

No corrections recorded.

To report an error in this entry, see corrections.