Google Antigravity Security: An Agentic IDE Now Ships as an Editor Extension

Google Antigravity security stopped being an application-inventory question on 20 August 2026. That is the date on Google's own blog post, "Introducing IDE Extensions", which put its agentic IDE inside Visual Studio Code, Visual Studio, Zed, JetBrains and Xcode. AlternativeTo covered it five days later, in an item bylined Fla, and counted four editors.

This is a distribution event, not a product to review on features. An agentic IDE that existed only as its own application was at least visible: an installer, a bundle, a version, a row in a software inventory. As editor extensions it arrives through marketplaces the endpoint owner does not run. It is the newest entry in the problem set covered in Securing AI Coding Agents and CLIs, next to Cursor, Copilot, Codex and Claude Code. Only the artifact type changed, and it changed to the worst one.

What the sources say, and where they actually conflict

Start with the vendor, because the vendor published first. Google's post frames the extensions as deliberately small: "Rather than trying to turn traditional editors into heavy multi-agent hubs, we built lightweight, high-performance integrations across all supported editors." The very next sentence promises rather more - developers install Antigravity "to gain access to conversations, customizations, and multi-agent orchestration that shares context with the rest of the Antigravity ecosystem". AlternativeTo's item repeats that capability list almost word for word, adds that the extensions "share context with the wider Antigravity ecosystem to support integrated workflows", and credits a post on X from Google for Developers rather than Google's own announcement. So the capability claim originates with Google, not with the aggregator.

That matters for how many disagreements there really are. We went looking for three. Reading Google's own post closes one outright and relabels a second, and the honest count is two.

• The date is settled, not disputed. Google's post is dated 20 August 2026; byteiota and The New Stack agree, and The Register covered the Gemini Enterprise bundling on 21 August. AlternativeTo's 25 August item is coverage of a five-day-old shipment, not a second launch. There is no conflict here to flag.
• The editor count is a real omission. AlternativeTo names four. Google names five, adding Xcode, and its enterprise documentation lists all five. That does not weaken the argument; it adds a marketplace to it, and one more row to the AI agent inventory you are trying to keep current.
• Multi-agent orchestration is the one genuine capability conflict, and it is partly Google against Google. Google's launch post puts orchestration in the extensions. byteiota, writing on 23 August 2026, says "Multi-agent orchestration and Antigravity's built-in Chromium browser subagent still require the desktop app." Google's Antigravity 2.0 feature documentation places the integrated terminal and the VCS panel on the desktop app, while its separate "Antigravity for IDEs" documentation gives the extensions a narrower headline list - "converse with agents in dedicated side panels, review granular inline diffs, inspect interactive plans, and execute multi-step engineering tasks" - but does carry its own Browser section, with allowlist, denylist and separate-Chrome-profile pages under it.

We flag that one rather than resolve it, because resolving it changes nothing about what lands on the laptop. Wherever the heavier orchestration actually runs, Google documents "a unified authentication system across all IDE extensions, the Antigravity CLI, and Antigravity 2.0 (Desktop)". One identity, governed or ungoverned, follows the developer across every surface.

Five marketplaces, and none of them yours

The middle column is the argument. Each entry is a separate submission process, review and release cadence for the same agent, and none belongs to the organization whose laptops it lands on. Ask which version is running on your fleet and the answer depends on which editor each developer uses.

The install itself is the second structural point. Installing an editor extension is a marketplace transaction inside an application already present, so it creates no MSI, PKG or macOS application bundle - the artifact software-inventory tooling keys on. That is a general property of extension distribution, not a claim that extensions bypass endpoint security. An agentic IDE arriving stops resembling a software install and starts resembling a plugin update nobody approved. Same asymmetry we work through at fleet scale in Governing AI Coding Assistants Across Your Fleet.

What Google Antigravity security controls actually cover, and where they stop

Google announced on 21 August 2026 that Antigravity is bundled into eligible Gemini Enterprise Standard, Plus and Standard Emerging Market licenses, with admin controls covering workspace sandboxing, browser and MCP server access, central audit logging, spend thresholds, pooled token quotas and usage metrics. Audit logging is a single toggle "capturing prompts, agent responses, and metadata for compliance reporting". The Register reported the same set that day. This is a fuller control surface than most agent vendors shipped in year one.

Read the coverage list carefully, though. Google's enterprise documentation states that enterprise integration is supported for Antigravity 2.0, the CLI and the IDE extensions - and then lists the extension surfaces as Visual Studio Code, Visual Studio (Preview), JetBrains (Preview), Zed (Preview) and Xcode (Preview). Only the VS Code extension carries no qualifier; on the other four the vendor itself says preview. The same documentation adds that "Antigravity IDE (standalone) is currently not supported for enterprise deployments", which is a fourth Antigravity surface again, distinct from both the desktop app and the extensions.

The remaining limit is structural rather than a shortcoming. Every one of those controls is console-side and predicated on a Gemini Enterprise license plus corporate identity. Google documents two sign-in paths: individuals use a personal Google Account, enterprises sign in with Gemini Enterprise or Google Cloud project credentials. So the gap is narrower than "nobody can see it" - but it is still a gap, and it is the one that matters on a managed laptop. A developer who signs in personally authenticates outside the tenant, so the console's audit log, MCP policy and sandboxing describe an install that is not theirs. A tenant-scoped record of prompts answers a different question than the one in Building an Audit Trail for AI Agents: what is installed, on which machine, configured how.

The terminal is a desktop capability today, and a direction of travel

A second AlternativeTo item, published 26 August 2026 by Mauricio B. Holguin, reports that Antigravity 2.0 added Git version control in the right-side panel, branch tracking and an embedded terminal. Google's own blog of 24 August 2026 describes a VCS panel with three views - Agent Edits, Uncommitted and Branch - tracking all changes against the branch, including "side effects from a bash script editing files", plus an embedded terminal for running tests, linters, build tools, package management and any other command line tool the developer needs.

Be precise about where that lives. Google's feature documentation places both the terminal and the VCS panel under Antigravity 2.0, the desktop application, and documents the extensions separately under "Antigravity for IDEs", whose own feature list has no terminal in it. The terminal is not a shipped extension feature and we will not pretend otherwise. What it shows is where an agent surface trends: toward a shell. An agent with a terminal is an agent with your shell.

Google's defaults are sound. Its documentation states that "By default, agents will request your explicit permission before running any terminal commands" and that "By default, your agent can only read and write within the provided folders". It documents three presets - Default, Full machine and Unrestricted - the latter two granting read and write across the full machine, rules evaluated Deny over Ask over Allow, scoped per project. Terminal execution has two modes: Request Review, prompting before every command not on a configurable Allow list, and Always Proceed, which Google labels high autonomy, high risk. Set that against Claude Code vs Codex vs Cursor permission models: the same design, different names.

The risk is not an unsafe default, it is drift. Presets are per project, Allow lists grow, and the developer who flips a project to Unrestricted at 6pm to unblock a build files no ticket. Google's own agent supplies the precedent: Gemini CLI's allowlist bypass into silent command execution is why "the agent asks first" is a default, not a boundary.

More artifacts travel with each install than the extension itself. Google's MCP documentation names four surfaces - Antigravity 2.0, Antigravity IDE, the Antigravity CLI and the Antigravity SDK - and Google surfaces that same MCP guide under Customizations in its "Antigravity for IDEs" documentation, alongside skills, rules, workflows, plugins and hooks. The Gemini Enterprise announcement lists browser and MCP server access among the admin controls covering the extensions. Every install can therefore carry its own MCP and customization state, reproducing the config drift documented for Cursor's .cursorrules and MCP surface.

IDE extensions have the worst record of any artifact type here

This is not speculation about the extension channel. It is what already happened on it.

None of that accuses Google's listings or says marketplaces skip review. It says the surface has a history, and an agentic IDE arriving on it inherits that history whatever the vendor's reputation.

Shared context, and the question worth asking the vendor

AlternativeTo reports that the extensions share context with the wider Antigravity ecosystem, and Google documents unified authentication across the extensions, the CLI and the desktop app. Both are vendor-stated features. Our reading, and it is a reading rather than a finding, is that an agent surface consuming untrusted input in one editor and carrying context to another is on paper a propagation path. No source demonstrates cross-editor propagation in Antigravity and we have not tested it. The closest evidence is Comment and Control, where GitHub comments hijacked Claude Code, Gemini CLI and Copilot agents.

Antigravity's own record gives the shape of the risk, and it is patched. The Hacker News reported on 21 April 2026 that Dan Lisichkin of Pillar Security chained permitted file creation with weak input sanitization in the native file-search tool: "By injecting the -X (exec-batch) flag through the Pattern parameter [in the find_by_name tool], an attacker can force fd to execute arbitrary binaries against workspace files." That escaped Strict Mode, which "limits network access, prevents out-of-workspace writes, and ensures all commands are being run within a sandbox context". Reported 7 January 2026, patched 28 February 2026; no CVE has been published for it as of this writing. SecurityWeek added that the trigger was indirect prompt injection via malicious comments in untrusted source files - Indirect Prompt Injection, Explained, delivered by cloning a repo.

Separately, SecurityWeek reported in April 2026 that Malwarebytes found a fake site, google-antigravity.com, distributing a trojanized installer that bundled the legitimate IDE with malicious PowerShell stealing browser passwords, cookies and autofill data. It targeted the desktop installer, not the extensions. Same play as the SEO-poisoning campaign behind fake Gemini CLI and Claude Code installers: popular agent, plausible download page, infostealer.

What Google Antigravity security looks like on an endpoint you manage

Ask what is physically present on a laptop afterwards. Five things, only one of which is the install event:

• An extension, in one of five editors, updating on that editor's channel, not yours.
• A signed-in identity, your Gemini Enterprise tenant or a personal Google Account. The console audit log describes only the first.
• Per-project security settings: which preset is active, and which terminal mode.
• An Allow list and a Deny list for terminal commands, edited locally, growing.
• MCP server entries, since Google documents MCP configuration under the customizations for its IDE extensions as well as for the desktop app and CLI - which puts each install inside the scope of MCP Server Security.

Four of those five are configuration state, not an install. That is the case for treating the endpoint as the system of record rather than a vendor console or a self-published catalog, the argument for endpoint discovery over agentic resource discovery.

The governable object is not the arrival. It is what it leaves behind.

How Anomity inventories Google Antigravity on the endpoint

An unprivileged Endpoint Sensor for Windows, macOS and Linux inventories eight AI artifact types per endpoint - AI agents, MCP servers, extensions, plugins, skills, secrets, hooks, and CLIs. Extensions are one of the eight, which is why an agentic IDE arriving as an editor extension is a data-collection question rather than a new integration. Inside Anomity Discovery covers how.

• Inventory. Every endpoint carrying an Antigravity extension, in which editor, with its MCP server entries and hook definitions beside it. That answers what the vendor console cannot: which machines, which channel, and whether the install is inside your tenant.
• Allow, deny or log at the hook, where one exists. Anomity enforces at an agent's own enforcement point, for example Claude Code's PreToolUse hook, per How Claude Code Hooks Work. Antigravity documents a hooks.json of its own, with PreToolUse and PostToolUse events, for the IDE extensions as well as the desktop app - which makes that file an artifact worth inventorying in its own right, since a hook is a shell command the agent runs. Anomity's enforcement runs at Claude Code's hook today, so for an Antigravity install what you get is inventory and change detection.
• A queryable 90-day audit trail of every added, changed or removed artifact - so a preset flipped to Unrestricted becomes a timestamped event on a named endpoint.
• Metadata only, secrets redacted on the endpoint - never source code, prompts or secret values. Events route to SIEM, Slack, email or Jira. Anomity is SOC 2 Type II and complements, not replaces, Network, EDR, DLP and GRC.

Google did the harder half well: real admin controls, real audit logging, safe defaults, documentation of what each preset changes. The half left over is the usual one - knowing which machines are inside that arrangement and which run the same agent on a personal account with a preset nobody enumerated. Book a demo to answer that from the endpoint, not the console.

Related

• Securing AI Coding Agents and CLIs (2026)
• How to Build an AI Agent Inventory
• Top 10 Enterprise AI Agents to Inventory and Govern (2026)
• Solidity Pro Extensions Steal AI, Cloud, and SSH Credentials
• When a Coding Agent Drops Your Database
• Why AI Agents and MCP Servers Are the New Shadow IT