The Antigravity Hope

Google showed off Antigravity, an AI-powered coding environment that is more than just an editor, on November 18, 2025. Antigravity is a “agent-first” programming environment that uses Gemini 3 Pro to help with or do hard-coding tasks on its own. Developers can let AI agents use the system’s terminal, browser, and file system to do things like write, debug, and test code.

The idea was huge. Antigravity’s agents could do a lot of things at once, switch between projects, and coordinate processes without having to be in the same place at the same time. They could also help with line-by-line code suggestions. It was built on a changed version of Visual Studio Code and had a familiar interface with AI features that worked well together. It also introduced the idea of a “Manager view” for managing agent activity across projects.

The global development community quickly looked at what it could do. But less than a day later, those possibilities came with big questions.

The Exploit that Changed Day One (Corrected)

Aaron Portnoy, the chief of research at the cybersecurity company Mindgard, released findings that stunned early adopters. Within 24 hours of Antigravity’s release, he demonstrated a serious weakness that allowed persistent code execution across multiple projects simply by modifying a global configuration file.

The issue centered on mcp_config.json, a file stored in a globally accessible directory that Antigravity referenced across sessions. When a user clicked “Trust this folder”—a normal part of Antigravity’s workflow—malicious code inside that workspace could update this global config. The injected code would then execute every time Antigravity was launched, regardless of which project the user opened.

There was no additional warning beyond the standard trust prompt. The backdoor persisted even after uninstalling and reinstalling Antigravity, because the malicious file remained outside the main installation directory.

Mindgard’s research confirmed the exploit on both Windows and macOS. More importantly, the vulnerability continued to function even when restrictive settings were enabled, making it a high-risk flaw in a high-privilege environment.

Why This Wasn’t Just a Mistake (Corrected)

The vulnerability did not stem from a rare edge case but from a design assumption. Antigravity relied on users to designate workspaces as trusted. Once trusted, the system extended broad permissions to the contents of that folder—including configuration files capable of influencing future sessions.

Visual Studio Code has a similar trusted-workspace concept, but Antigravity’s AI agents operate with broader, more persistent permissions. Security researchers noted that this difference required a more robust trust model than traditional IDEs.

Portnoy’s proof-of-concept illustrated how easily this could be abused: a seemingly helpful agent or shared project could contain a modified config file. Once a developer trusted the workspace, the backdoor would activate—requiring no further interaction.

Google’s Official Response and the Fix That Wasn’t (Corrected)

Google acknowledged the vulnerability and thanked Portnoy for the responsible disclosure. A bug report was created, and Google said the issue was under investigation. As of this writing, no public patch has been released.

Antigravity remains available for download, and Google has not yet added explicit warnings about this specific vulnerability. Developers currently must inspect or reset global config files manually to ensure no malicious entries persist.

Can Antigravity Still Reach Its Goals?

Even though Antigravity had a problem at first, it shows how developers might change the way they work with code. It wasn’t supposed to be a plugin. It was made to be a complete environment where AI doesn’t simply recommend code; it also writes, tests, interacts, and navigates. That feature still gets a lot of attention from business developers, freelancers, and researchers all over the world.

It is an architectural problem. For Antigravity to go forward, faith can’t be all or nothing. Google would need to include more detailed permissions, sandboxed agent environments, clearer information on what each agent does, and better separation between projects.

People in the security community have come up with some ideas, such as:

• Making mcp_config.json particular to a project or password-protected
• Adding alerts when changes are made to global config files
• Keeping track of all agent activity that lasts a long time
• By default, limiting agent access and requiring explicit opt-ins

These modifications may sound technical, but they are very important for more people to use them, especially now that companies are starting to try out autonomous development environments.

A Moment for the Whole Industry

There are several ways to walk this line besides antigravity. The issue has brought back up discussions about how safe AI systems are, especially those that combine standard developer access with self-driving agents. Antigravity now has to answer questions that are important to the whole industry:

• How do AI agents deal with permissions?
• Can users check what an agent performs once it has been set up?
• Are settings that stay the same being checked?

Developers from Europe, North America, and Asia have all had their say on GitHub bugs, Discord discussions, and tech forums. Most people agree that authority without rules doesn’t work well. AI development tools, more than other types of tools, need a new way to handle security.

What’s Next for Google and Antigravity

The release of Antigravity and its immediate weakness signify a turning point.

Platforms can’t just ship powerful AI features anymore. Expectations about security are changing. Developers desire performance, but not if it means hidden persistence or trust structures that are easy to break.

The next public update from Google will be important. The company has a chance to define a standard for AI-first IDEs, whether it’s through a patch, new documentation, or a new trust architecture. If people work together and are honest about it, Antigravity could still be the best in this area. But if solutions take too long or don’t work, developers may go for other options that have better built-in security.

For now, the platform is still changing. It was a bold notion that was tested early on in the real world, and it serves as a reminder that control should always come first when making tools for automation.