Google shipped Antigravity 2.0 at I/O on May 19, 2026, and in doing so turned one AI IDE into five things: a standalone desktop app, a Go-based CLI, an SDK, a Managed Agents tier inside the Gemini API, and an enterprise path through Gemini Enterprise. A month later, on June 18, Gemini CLI stopped serving Google AI Pro, Ultra, and free Code Assist users, which pushed a large group of developers onto Antigravity CLI whether or not they had ever evaluated it.
That is a lot of new surface for a product whose first security bug was found 24 hours after launch.
TL;DR
Antigravity is workable for most projects if you configure it deliberately. The critical one, a Strict Mode escape that turned prompt injection into code execution, was patched on February 28, 2026, so run a current build and that specific hole is closed. The risk that is still yours to manage is configuration: Antigravity 2.x consolidated the desktop app, the CLI, and the SDK onto a single ~/.gemini/config/mcp_config.json, so one poisoned entry runs code across all three. Open that file, then scan what the agent wrote before you ship it.
Our Verdict
Use with CautionWhat's Good
- Strict Mode plus sandboxed terminals on macOS, Linux and Windows
- Granular Allow/Deny Lists and a
proceed-in-sandboxapproval mode - Google patched the Pillar Security RCE in 52 days
- Public changelog you can actually audit
- Works with multiple models (Gemini, Claude, GPT)
What to Watch
- One shared MCP config now drives desktop, CLI and SDK
- Two published agent-specific exploits in the first year
- Source code leaves your machine on every agent interaction
- Managed Agents run your code on Google infrastructure, not yours
- Forced migration put Gemini CLI users here without an evaluation
What Changed in 2.0
The March version of this review covered a single IDE in public preview. That product is gone. Here is the shape of it now, and why each piece changes your exposure.
| Surface | What it is | Security consequence |
|---|---|---|
| Desktop 2.x | Standalone agent-first app, currently v2.4.3 | Same trust model as before, more autonomy per prompt |
| Antigravity CLI | Go rewrite of Gemini CLI, currently v1.1.9 | Runs headless in terminals and CI, where nobody is watching approvals |
| SDK | Programmatic agent control | Your automation inherits whatever permissions you granted |
| Managed Agents | Isolated Linux environments in the Gemini API | Your code executes on Google infrastructure, with state persisted between calls |
| Gemini Enterprise | Org-level deployment | Config decisions become org-wide, not per-developer |
The CLI is the one to think hardest about. A desktop app can put an approval dialog in front of you. A CLI running in a build script cannot, and Google's own changelog shows the approval rules getting looser over time: v2.4.3, shipped July 28, 2026, "refined command approval rules to reduce redundant permission prompts for everyday tools." Fewer prompts is a real usability win and a real reduction in the number of times you look at what the agent is about to run.
If you were pushed here by the Gemini CLI shutdown, you likely inherited defaults you never chose. Antigravity CLI is not a drop-in rename of Gemini CLI. It executes commands, reads MCP servers, and has its own approval policy. Spend ten minutes in the settings before you point it at a repo that matters.
The Strict Mode Escape (Patched)
This is the one that mattered, and it is worth understanding even though it's fixed, because the shape of it will repeat.
Antigravity ships a file-searching tool called find_by_name, which is a wrapper around the fd utility. The tool accepted a Pattern parameter and passed it through without sanitizing it. fd supports a -X flag, short for exec-batch, which hands every matched file to a program of your choosing.
So a Pattern value of -Xsh stopped being a search pattern and became an instruction: take every file you match and feed it to the shell.
Why this was worse than it sounds. The attacker did not need your password, your account, or a malicious extension. A hidden comment inside a file you cloned from a public repo was enough. The agent reads the file, the injected text becomes an instruction, and the instruction escapes Strict Mode. This is prompt injection crossing from the data channel into the command channel, and it worked against a tool specifically built to prevent that.
Dan Lisichkin of Pillar Security, who found it, put it plainly: "By injecting the -X (exec-batch) flag through the Pattern parameter, an attacker can force fd to execute arbitrary binaries against workspace files."
The disclosure timeline:
Pillar Security reports the flaw to Google.
Google acknowledges and accepts the report.
Patch deployed. 52 days from report to fix.
Public disclosure.
Fifty-two days is a respectable turnaround for a critical bug. If you are running a build from before March 2026, you are running the vulnerable one. Update.
The Config File You Should Actually Open
Here is the check to run today, and it takes about five seconds.
Mindgard found a different problem within a day of Antigravity's launch, and it never depended on a parsing bug. Antigravity treats user-defined rules as absolute, with the literal instruction "The following are user-defined rules that you MUST ALWAYS FOLLOW WITHOUT ANY EXCEPTION." Put a Markdown file in a project's .agent directory telling the agent to copy an MCP config to the global location, and the agent obliges. From then on, that config loads on every launch, in every project.
Mindgard's summary: "This essentially allows one compromised workspace to be a permanent backdoor for all Antigravity sessions in the future." It survived uninstalling and reinstalling the app, because the file was never part of the app.
Google's first response was to close it as "Won't Fix (Intended Behavior)," then quietly widen the known-issues documentation, then reopen the ticket after the research went public.
In Antigravity 2.x, the desktop app, the CLI and the SDK all read one config:
cat ~/.gemini/config/mcp_config.json
Every entry in that file is a program Antigravity will start on your behalf. If you see a server you don't recognize, or a command pointing at a path you never installed, delete the entry. Also look inside any repo you cloned recently:
find . -path ./node_modules -prune -o -name ".agent" -type d -print
ls -la .agent/ 2>/dev/null
A .agent directory in someone else's repository is not automatically malicious. Plenty of projects ship legitimate agent rules. But you should read them before opening the project, because the agent will follow them with the priority the documentation promises.
Treat cloning a repo as running its code. Between MCP configs, .agent rules, and postinstall scripts, the gap between "I opened this project" and "this project executed something" is now very small. The same instinct applies to npm dependencies and any AI tool with filesystem access.
How Antigravity Handles Your Code
Every agent interaction sends source context to Google's servers. That is true of every cloud AI coding tool, but agentic mode sends more than autocomplete does: the files you're editing plus files the agent decides are relevant, your prompts and conversation history, terminal output, and stack traces.
Managed Agents raise this further. Your code doesn't just get read on Google's infrastructure, it runs there, in a persistent Linux environment that keeps files and state between API calls. For a side project that's fine. For anything with a compliance story, that's a decision to make on purpose rather than discover later.
Google's position is that this data is processed rather than stored long-term or used for training by default. Enterprise tiers add isolation guarantees. The individual-tier language around "product improvement" remains loose enough that you should exclude anything you'd mind seeing in a log.
Exclusion rules before first run. Agentic mode reads across your whole project to build context. .env files, private keys, and credential files anywhere in the tree can end up in the context window. Configure exclusions first, not after the first session.
The Permission System
Three controls do most of the work, and the terminology changed in 2.x.
Strict Mode replaced what used to be called Secure Mode. It restricts what the agent can execute directly. It is the setting the find_by_name bug bypassed, which is a useful reminder that a mode is only as strong as the tools it wraps.
Terminal sandboxing now covers macOS, Linux, and Windows, and the proceed-in-sandbox approval mode auto-approves commands that stay inside the sandbox while still asking before anything escapes it. This is the setting most people should be on. Google also added .git to the list of dangerous paths requiring explicit confirmation, which closes off a category of quiet damage.
Allow and Deny Lists are unchanged in concept. Allow npm test, git status, ls. Deny anything that changes permissions or pipes the internet into a shell.
Deny List starting point: chmod, chown, rm -rf, curl | bash, wget | sh, sudo, and anything writing to ~/.gemini/. That last one is new advice and it exists because of the MCP persistence issue above. Your agent has no legitimate reason to edit its own global config.
The chmod -R 777 behavior early adopters reported has not gone away as a class of problem. An agent that hits "Permission Denied" while fixing a bug will reach for the fastest thing that makes the error stop. That was never a vulnerability in Antigravity. It's what optimization without judgment looks like, and it's the reason the Deny List exists.
Generated Code Is Still the Bigger Risk
Two published exploits get the attention. The code the agent writes is what actually shows up in scans.
| Risk | Likelihood | What to check |
|---|---|---|
| Missing authentication on an endpoint | High | Verify every route checks auth, not just the ones with a login page |
| Missing input validation | High | Test edge cases on all user inputs |
| Hardcoded API keys | Medium | Grep for string literals that look like tokens |
| Permissive CORS | Medium | Check for Access-Control-Allow-Origin: * |
| SQL injection | Low-Medium | Confirm parameterized queries |
Multi-agent mode makes the inconsistency problem worse. When several agents work the same repo in parallel, you get auth middleware on one route and not the next, validation on the client but not the API, environment variables in some files and literals in others. Each agent's work is locally coherent. The union of it isn't.
Scan the whole project, not the diff. After an agentic session, especially a multi-agent one, the set of files that changed is rarely the set of files you expected. CheckYourVibe checks the full deployed surface, which is where the mismatch between agents shows up.
Antigravity vs Cursor vs Windsurf
| Feature | Antigravity 2.x | Cursor | Windsurf |
|---|---|---|---|
| Parent company | Anysphere | Cognition | |
| Permission system | Strict Mode + Allow/Deny Lists | Limited | Settings-based |
| Terminal sandboxing | macOS, Linux, Windows | Basic approval | Basic approval |
| CLI | Yes (Go) | Yes | Yes |
| Published agent exploits | 2 (one patched, one contested) | Fewer public | Fewer public |
| Compliance certs | Enterprise tier | SOC 2 | SOC 2, HIPAA, FedRAMP |
| Self-hosted option | No | Enterprise | No |
Antigravity has the strongest permission model on paper and the most public bruises, which is partly a function of being the most researched. Windsurf still leads on compliance paperwork. Cursor has the longest run without a headline agent escape.
For a deeper look at the editors, see our Cursor vs Windsurf breakdown.
How to Use Antigravity Safely
Check your MCP config first
Run cat ~/.gemini/config/mcp_config.json and confirm you recognize every server. This one file drives the desktop app, the CLI, and the SDK in 2.x.
Update to a current build
The Strict Mode escape was patched February 28, 2026. Anything older than March is vulnerable to a published, documented exploit.
Turn on sandboxed terminals
Use proceed-in-sandbox rather than blanket auto-execution. Build the Deny List before the Allow List, and include ~/.gemini/ in it.
Read .agent directories in repos you clone
Agent rule files carry absolute priority by design. Reading someone else's before you open their project is the same instinct as reading a postinstall script.
Exclude secrets from context
.env files, keys, and certificates. The agent doesn't need your Stripe secret to build a checkout form.
Scan after every agentic session
Especially multi-agent ones. Auth gaps between files are the signature failure, and they don't show up in the diff you reviewed. MCP server integrations add their own surface worth checking.
Is Google Antigravity safe to use in 2026?
Antigravity is reasonable for most development work if you lock down terminal permissions and check your MCP config. The critical Strict Mode escape found by Pillar Security was patched on February 28, 2026. The open risk is configuration, not the binary: a single global mcp_config.json now drives the desktop app, the CLI and the SDK together.
What is the Antigravity mcp_config.json file and why does it matter?
It is the file that tells Antigravity which Model Context Protocol servers to launch, and launching an MCP server means running a program on your machine. In Antigravity 2.x it lives at ~/.gemini/config/mcp_config.json and is shared by the IDE, the CLI and the SDK, so one bad entry affects all three. Open it and confirm you recognize every server listed.
Was the Antigravity remote code execution bug fixed?
Yes. Pillar Security reported a Strict Mode escape through the find_by_name tool on January 7, 2026, Google accepted it on January 24 and shipped a patch on February 28, with public disclosure on April 20. Separately, Mindgard reported an MCP config persistence issue that Google first closed as intended behavior and reopened after disclosure. Run a current build.
Do I have to switch from Gemini CLI to Antigravity CLI?
If you were on Google AI Pro, Ultra, or the free Gemini Code Assist tier, yes. Gemini CLI and the Gemini Code Assist IDE extensions stopped serving those plans on June 18, 2026. Gemini Code Assist Standard and Enterprise licenses were not affected.
Is Antigravity safer than Cursor or Windsurf?
Antigravity has the more granular permission model, with Strict Mode, sandboxed terminals and Allow/Deny Lists. It also has the shortest track record and two published agent-specific exploits in its first year. For all three tools the code the agent writes is a bigger risk than the tool itself.
Built with Antigravity?
Agents write code fast and skip the auth check on route four. Scan your project in 60 seconds and find what they missed.