Preliminary research

RCE in Google's AI code editor Antigravity - $10000 Bounty

RCE in Google's AI code editor Antigravity

sudi · Hacktron AI · 8 February 2026

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Examines an overbroad browser-extension messaging interface that forwarded web-origin requests with authority to Antigravity’s authenticated local service, enabling a chosen-path file write. Startup-file execution required a later login or restart; the authentication token itself was not disclosed.

Record

Document

RCE in Google's AI code editor Antigravity

Researcher

sudi

Published by

Hacktron AI

Date

8 February 2026

Topic

Server

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• browser-extension
• abuse-of-functionality
• file-write
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of sudi, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 22 September 2026.