Before a Stray Instruction in a Fetched Page Drives Your Unattended Agent — Tainting Inputs to Downgrade Capabilities
So an unattended agent that reads external pages or PDFs can't be hijacked by an instruction hidden inside them: track the taint of every input and automatically downgrade side-effecting tools. With working Python and real operational numbers.
Strip Secrets Out of the Agent Logs You Keep: Designing a Redaction Layer
Once you start keeping logs from unattended agents, a token or API key eventually lands in them in plaintext. Rotating the key doesn't unmake the leaked log. This designs a redaction layer that reliably drops secrets right before the write, going beyond regex to register known secrets and mask them for certain, with working Python and field notes.
Your Antigravity Sandbox Isolates Multi-Agents Less Than You Think — Notes on Containing the Blast Radius
An Antigravity sandbox gives you the feeling of isolation, but isolation leaks through three real gaps: shared volumes, over-broad allowed domains, and approval fatigue. Field notes on plugging the leaks, containing the blast radius by design, and proving isolation holds with tests.
Pairing a Local LLM With Antigravity to Keep Sensitive Code Off the Cloud
Should you really let a cloud agent read code that holds your billing keys and revenue logic? For indie developers that worry is concrete. Here I pair Ollama and Gemma as a local LLM with Antigravity, routing sensitive parts to local and general parts to the cloud, with the decision rules and measurements.
Keeping Secrets Out of Your Antigravity Agent's Output: Layered Defenses for Logs, Diffs, and PR Bodies
The three paths through which background agents leak secrets, and how to defend commit diffs, execution logs, and PR bodies with layered protection, drawn from running six apps and measured false-positive rates.
Integrating Gemma 4 Into Antigravity — A for Offline and Air-Gapped AI Development
With Apache 2.0–licensed Gemma 4, you can now run Antigravity's agent experience inside confidential or offline projects. Here is the full implementation walkthrough — Ollama/vLLM wiring, Architect/Builder prompt tuning, and production gotchas.
Multi-Agent CI/CD Quality Gate — Automating PR Review, Testing, and Security with Antigravity × GitHub Actions
A complete implementation guide for building a multi-agent CI/CD quality gate using AgentKit 2.0 and GitHub Actions. Covers parallel code review, test generation, and security scanning agents — with production cost management and pitfall solutions.
Stopping Server Action Foot-Guns Before Antigravity Ships Them — Zod, revalidate, and Authorization Built In From the First Draft
Ask Antigravity to write a Next.js Server Action and you'll often get back code with no Zod parsing, no revalidate call, and no authorization check. Here's how to bake those in from the start instead of patching them on later.
Keep the Wrong Files Out of Antigravity's AI Context — A Practical Guide to Blocking Secrets and Noise
A hands-on guide to keeping .env files, secrets, and build artifacts out of Antigravity's AI context. Lock down sensitive material while reducing token spend and improving response quality.
Giving Antigravity Agents Safe Write Access — Production Permission Boundary Design
A practical guide to designing Permission Boundaries that let AI agents safely touch production databases, deploys, and billing APIs — with dry-runs, approval queues, and audit logs.
Mastering Antigravity's `.antigravityignore` — Designing What You Let the AI See
The `.antigravityignore` file controls which files Antigravity's AI agents and indexer can read. This guide walks through how it differs from `.gitignore`, the baseline patterns to start with, and the design decisions that make the agent both faster and safer.
Prompt Injection Defense in Antigravity — A Production Security Playbook for LLM Apps
Build a four-layer prompt injection defense inside Antigravity with working Python. Includes measured heuristic recall across eight obfuscations and the normalization bug that breaks detection for non-Latin scripts.