Google Antigravity in Crosshairs of Security Researchers, Cybercriminals

Summary

Researchers at Pillar Security discovered a remote code execution vulnerability in Google Antigravity, an AI-powered development platform, caused by insufficient input sanitization that allows sandbox escape and arbitrary code execution. The vulnerability was patched in late February, but cybercriminals are simultaneously exploiting Antigravity's popularity by distributing trojanized installers through a fake domain (google-antigravity.com) that deploys stealer malware capable of harvesting browser data, cryptocurrency wallets, and enabling keystroke logging and clipboard hijacking.

Full text

Google Antigravity’s increasing popularity has brought the development platform into the crosshairs of both security researchers and cybercriminals. Google Antigravity is an ‘agent-first’ development platform that evolves the traditional code editor into a mission control for autonomous AI agents. Powered by Gemini, the IDE enables developers to delegate complex, multi-step engineering tasks to independent AI workers that can plan, execute, and verify code. Antigravity vulnerability Researchers at Pillar Security discovered that Antigravity is affected by a vulnerability that can allow an attacker to escape the sandbox and remotely execute arbitrary code. The flaw, which Google patched in late February, is caused by insufficient input sanitization in a parameter, enabling an attacker to inject commands that would get executed via a file search operation. The researchers demonstrated how an attacker could stage a malicious script and execute it via an apparently legitimate search. The attack method bypassed Antigravity’s Secure Mode. “The same behavior can be triggered via indirect prompt injection without any prior compromise of the user’s account,” Pillar researchers explained. “A user pulls a benign-looking source file from an untrusted origin, such as a public repository, containing attacker-controlled comments that instruct the agent to stage and trigger the exploit.”Advertisement. Scroll to continue reading. Antigravity’s popularity used for malware delivery Researchers at Malwarebytes discovered that a Google search for Antigravity could lead users to a fake website set up to serve a trojanized installer. They noticed that the domain google-antigravity(.)com, which hosts a fake Antigravity website, delivers an installer that actually installs the IDE platform. However, it also deploys two PowerShell scripts that enable attackers to deliver an additional payload: a stealer malware designed to harvest sensitive data from the compromised system. The malware targets browser data (saved passwords, cookies and autofill data), messaging applications, cryptocurrency wallets, gaming platforms, and FTP clients. “Beyond data theft, the malware also imports Windows APIs used for clipboard hijacking and keystroke logging, tools that can capture what you type or swap a cryptocurrency wallet address at the exact moment you send funds,” Malwarebytes researchers explained. They added, “It also includes the building blocks for ‘hidden desktop’ tradecraft: creating a second, invisible Windows desktop that the attacker can capture and potentially control. In its most advanced form, this lets an attacker operate inside that hidden environment—logging in to accounts, approving transactions, or sending messages—while the victim’s real screen shows nothing unusual.” Related: Cursor AI Vulnerability Exposed Developer Devices Related: Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments Related: OpenAI Impacted by North Korea-Linked Axios Supply Chain Hack Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. More from Eduard Kovacs Serial-to-IP Converter Flaws Expose OT and Healthcare Systems to HackingBluesky Disrupted by Sophisticated DDoS AttackNext.js Creator Vercel HackedAnother DraftKings Hacker Sentenced to PrisonRecent Apache ActiveMQ Vulnerability Exploited in the WildZionSiphon Malware Targets ICS in Water FacilitiesOpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos RevealData Breach at Tennessee Hospital Affects 337,000 Latest News Oracle Patches 450 Vulnerabilities With April 2026 CPUThird US Security Expert Admits Helping Ransomware GangDozens of Malicious Crypto Apps Land in Apple App StoreUnsecured Perforce Servers Expose Sensitive Data From Major OrgsProgress Patches Multiple Vulnerabilities in MOVEit WAF, LoadMasterOrganizations Warned of Exploited Cisco, Kentico, Zimbra VulnerabilitiesData Breaches at Healthcare Organizations in Illinois and Texas Affect 600,000$290 Million Kelp DAO Crypto Heist Blamed on North Korea Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: A Step-by-Step Approach to AI Governance April 28, 2026 With "Shadow AI" usage becoming prevalent in organizations, learn how to balance the need for rapid experimentation with the rigorous controls required for enterprise-grade deployment. Register Virtual Event: Threat Detection and Incident Response Summit May 20, 2026 Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register People on the MoveAnti-ransomware platform Halcyon has named Kirstjen Nielsen and Chris Inglis as Strategic Advisors.ThreatModeler has appointed Kevin Gallagher as Chief Executive Officer.Thomas Bain has been appointed Chief Marketing Officer at Silent Push.More People On The MoveExpert Insights Government Can’t Win the Cyber War Without the Private Sector Securing national resilience now depends on faster, deeper partnerships with the private sector. (Steve Durbin) The Hidden ROI of Visibility: Better Decisions, Better Behavior, Better Security Beyond monitoring and compliance, visibility acts as a powerful deterrent, shaping user behavior, improving collaboration, and enabling more accurate, data-driven security decisions. (Joshua Goldfarb) The New Rules of Engagement: Matching Agentic Attack Speed The cybersecurity response to AI-enabled nation-state threats cannot be incremental. It must be architectural. (Nadir Izrael) The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust Data integrity shouldn’t be seen only through the prism of a technical concern but also as a leadership issue. (Steve Durbin) Why Agentic AI Systems Need Better Governance – Lessons from OpenClaw Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access, (Etay Maor) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• domain — google-antigravity.com
• malware — Stealer malware (unnamed)

Entities