Keep the Self-Debugging Agent Away From Live Ads: Three Layers Against AdMob Invalid Traffic

Layer 2: Block the network in the agent's environment

Self-debug drives the app or site from the outside. So the surest move is to stop ad-serving traffic in the environment where the agent runs. Even if the test-ID swap leaks, no request leaving the box means no production impression.

In the agent sandbox or verification container, make the major ad-serving domains unresolvable.

#!/usr/bin/env bash
# block-ad-domains.sh — block ad-serving domains in the agent verify environment
set -euo pipefail
 
HOSTS=/etc/hosts
MARKER="# --- agent-verify ad block ---"
 
if grep -q "$MARKER" "$HOSTS"; then
  echo "Already applied"
  exit 0
fi
 
cat <<'BLOCK' | sudo tee -a "$HOSTS" >/dev/null
# --- agent-verify ad block ---
127.0.0.1 googleads.g.doubleclick.net
127.0.0.1 pagead2.googlesyndication.com
127.0.0.1 securepubads.g.doubleclick.net
127.0.0.1 tpc.googlesyndication.com
127.0.0.1 www.googleadservices.com
# --- end agent-verify ad block ---
BLOCK
 
echo "Ad-serving domains blocked (consent-form fetch uses other domains, so it still works)"

The gotcha here is over-blocking. If you cut off the consent platform (UMP) form fetch or your app's own API, the very flow you wanted to verify stops working. Target only the ad-serving domains and let the rest through. That line is what keeps verification reproducible. If you have ever tripped over consent initialization order, the ATT-before-ad-SDK init-order bug pairs well with this and makes the order-versus-blocking relationship easier to grasp.

Layer 3: A preflight gate that rejects production ad builds

The third layer stops human mistakes with a machine. However well you arrange layers one and two, a single "I forgot to set the test flag today" undoes them. So, right before launching self-debug, inspect whether the build still carries active production ad unit IDs, and refuse to start if it does.

#!/usr/bin/env python3
"""preflight_ad_guard.py — refuse to launch self-debug against a production ad build.
Exit 1 if any production AdMob unit ID remains in build output or config."""
import os
import re
import sys
from pathlib import Path
 
# Common prefix of Google's public test app/unit
TEST_PUB = "ca-app-pub-3940256099942544"
# Production unit shape: ca-app-pub-XXXX/YYYY that is not the test prefix
UNIT_RE = re.compile(r"ca-app-pub-\d{16}/\d{6,}")
 
def find_prod_units(root: Path) -> list[str]:
    hits = []
    targets = [".plist", ".xml", ".json", ".js", ".ts", ".dart", ".kt", ".swift"]
    for path in root.rglob("*"):
        if path.suffix not in targets or not path.is_file():
            continue
        try:
            text = path.read_text(encoding="utf-8", errors="ignore")
        except OSError:
            continue
        for m in UNIT_RE.findall(text):
            if not m.startswith(TEST_PUB):
                hits.append(f"{path}: {m}")
    return hits
 
def main() -> int:
    if os.environ.get("AGENT_VERIFY") != "1":
        print("AGENT_VERIFY=1 is not set. Always verify under this flag.")
        return 1
    root = Path(sys.argv[1]) if len(sys.argv) > 1 else Path(".")
    hits = find_prod_units(root)
    if hits:
        print("Production ad unit IDs detected. Aborting self-debug:")
        for h in hits[:20]:
            print("  -", h)
        return 1
    print("No production ad units found. Self-debug allowed.")
    return 0
 
if __name__ == "__main__":
    sys.exit(main())

Wire this into the front of any workflow where you hand self-debug to the agent. Whether in an Antigravity task definition or a CI verification job, pinning the first step to "preflight must pass" means one forgotten flag can no longer let production ads run. The idea of aiming verification at a disposable preview is covered in pointing real-browser self-debug at a throwaway preview; think of these three layers as that same principle applied to one concrete side effect, ads.

What actually changed after adding the three layers

I measured two weeks before and two weeks after, on one wallpaper app whose flow wraps an ad. Self-debug run counts were kept roughly equal.

The numbers look modest. But driving self-debug impressions to zero cannot be measured in revenue swings. The real gain is leaving no trace of suspicion on the account. On both the App Store and Google Play, account health is slow to rebuild once you lose it.

One thing surprised me. I had assumed the test-ID swap in layer one would be enough. Yet with a mediated interstitial, one adapter was still calling a production endpoint. Without the network block in layer two I would never have seen it. That experience convinced me the three layers are not redundant; each closes a different hole.

Wrapping up: start with preflight

You do not need all three layers at once. If you add just one today, I would recommend the layer-three preflight gate. Without touching the existing app, dropping one check in front of self-debug stops the worst accident: verifying against a production ad build. Forced test IDs and network blocking can then be stacked on, one at a time.

The more you hand to an agent, the more you owe it to yourself to know what runs on the other side of that handoff. I was lucky to catch the ads under my feet from this one incident. If it helps you pause at the same spot, I am glad. Thank you for reading.