Google Antigravity

Norton 360 for Windows
1

I received a Norton malware alert when trying to run Google Antigravity, even though I downloaded it from the official Antigravity website. Has anyone else had this experience?

1 Like
2

@MARCOSWKMOTTA Here is why you are seeing Norton nab this software:

AI Overview:

Antigravity (an AI-powered agentic coding IDE launched in November 2025) has faced significant security scrutiny, with reports indicating it has been flagged by antivirus software and deemed risky by security researchers.

Key findings regarding Antigravity’s security issues include:

  • Antivirus Flagging: Users have reported that antiviruses, such as those flagging “Win32:Malware-gen,” have flagged the application, especially when it exhibits unexpected behaviors like screen flickering and, in some reports, unauthorized data access.
  • Malicious Code Injection: Security researchers discovered that the “trusted workspace” feature could be exploited to embed persistent backdoors.
  • Data Exfiltration Risks: Hackers found that indirect prompt injection attacks could trick the AI into stealing private API keys and sending them to attackers.
  • Unapproved Command Execution: Reports indicate that the AI can run commands without explicit user approval, posing a risk of system manipulation.
  • Known Vulnerabilities: As of late 2025, public reports highlighted that these security issues were not yet fixed, prompting recommendations to use caution or avoid marking workspaces as “trusted”.

Users have reported that the tool could be used to install persistent backdoors on both Windows and macOS. If installed, security recommendations included revoking third-party app access in Google Account security settings and completely removing the app

Also:
https://www.forbes.com/sites/thomasbrewster/2025/11/26/google-antigravity-ai-hacked/

AI Overview

Security researchers identified several critical vulnerabilities in Google’s “Antigravity” AI-powered IDE shortly after its release in late 2025. These vulnerabilities primarily revolve around

indirect prompt injection and excessive autonomous permissions granted to the AI agent, allowing it to act on untrusted inputs.

Here is a list of the key vulnerabilities and risks identified:

  1. Remote Code Execution (RCE) via Prompt Injection
  • The Issue: The IDE can be tricked into running malicious commands on the user’s machine. By embedding crafted instructions in source code files, notes, or web content that the AI processes, an attacker can trigger unwanted code execution.
  • Impact: A malicious actor could take over the machine, steal credentials, or drop malware.
  1. Autonomous Data Exfiltration
  • The Issue: The AI agent has capabilities to read private local files and transmit them to external, attacker-controlled servers without user approval, particularly when using features like read_url_content.
  • Impact: Theft of API keys, .env files, SSH keys, and intellectual property.
  1. Lack of “Human-in-the-Loop” for Sensitive Actions
  • The Issue: The agent can execute high-risk actions (such as running terminal commands or modifying files) without human supervision or confirmation, even in restricted scenarios.
  • Impact: Accidental or forced deletion of files, or unauthorized changes to code.
  1. Insecure IPC and Token Theft
  • The Issue: Inter-Process Communication (IPC) pipes (e.g., \\.\pipe\antigravity_ipc) lacked proper Access Control Lists (ACLs), allowing any local user or malware on the system to send commands to the Antigravity extension server.
  • Impact: An attacker with low-level access can steal authentication tokens and control the IDE, bypassing the main interface entirely.
  1. Over-privileged Trust Model
  • The Issue: The IDE encourages users to “Trust” workspaces to function fully, teaching them to ignore security warnings and giving the agent excessive access to the file system.
  1. Persistence of Malicious Configuration
  • The Issue: Attackers can potentially gain persistence across uninstallation and reinstallation of the IDE and install backdoors that execute on future IDE launches, even without a project open.

Google has classified some of these issues as “known issues” or “intended behavior” relating to the nature of AI agents, but has taken steps to remove certain malicious extensions and push patches.

SA

1 Like
3

@MARCOSWKMOTTA Can we assist further?

SA