Antigravity and Codex security: stopping secret leaks with hooks and sandboxes

A ReclaimLLM analysis compares how Google Antigravity and OpenAI Codex handle secret exfiltration, finding that neither stack protects secrets by default: post-tool hooks cannot redact output that has already run, and Antigravity's hook crash or timeout fail mode is undocumented as of an October 2026 documentation review. The writeup notes that Antigravity's CLI defaults its terminal sandbox off (auto-enabled in auto mode) while the Antigravity App enables it by default, and recommends combining pre-tool hooks, network limits, env-file controls and reviewable session capture.

Originally published at ReclaimLLM https://reclaimllm.com/blogs/antigravity-codex-secret-leaks . How Google Antigravity and OpenAI Codex agents read, print, and send secrets; what hooks and sandboxes cover; and where vendor docs leave failure modes undocumented. agy defaults sandbox off auto-enables in auto mode . Google’s hook crash/timeout fail mode is undocumented. read-only , workspace-write default , danger-full-access ; approvals on-request / never . Google Antigravity and OpenAI Codex both offer hooks that can deny a tool call before it runs, plus sandboxes or approval boundaries that limit what shell commands can do. Neither stack gives you secret protection by default: post-tool hooks cannot undo side effects, and hook failures do not always block the underlying action. For a team rolling out either agent in 2026, the practical answer is to combine pre-tool hooks, network limits, env-file controls, and session capture you can review after the fact. This guide compares Antigravity and Codex side by side: where secrets leak, what each vendor documents, and how ReclaimLLM extends both with shipped hooks, env DLP, and an egress guard. Facts about vendor behavior were checked against public documentation in October 2026; re-verify Antigravity docs before you change production policy—they change often. Every coding agent faces the same three exfiltration paths, whether the model runs in the cloud or on your laptop: .env , key files, or config that holds credentials. For a vendor-neutral map of those paths and the control layers that address them, see What is AI DLP?. The sections below focus on Antigravity and Codex specifically. On June 18, 2026, Google announced that Gemini CLI and Gemini Code Assist IDE extensions would stop serving Google AI Pro/Ultra and free individual users. Gemini Code Assist Standard/Enterprise and paid API-key users can keep using Gemini CLI. For everyone else, Antigravity CLI agy is the replacement path. Timeline note: Antigravity as an IDE existed before that cutover. Research such as PromptArmor’s exfiltration write-up and Simon Willison’s commentary 25 November 2025 predates the June 2026 consumer CLI transition—they describe Antigravity-era behavior, not the later Gemini CLI → agy migration by itself. Antigravity loads hooks from project .agents/hooks.json and user ~/.gemini/config/hooks.json . Documented events include SessionStart, PreToolUse, PostToolUse, PreInvocation, PostInvocation, and Stop. On PreToolUse, decisions include allow, auto approve, deny, ask, force ask, and deny unless prior grant, and hooks can overwrite tool input before execution. See Antigravity hooks. PostToolUse does not receive tool output in the documented hook payload—only an error field when something failed—so post-tool hooks cannot redact what already ran. Prevention has to happen at PreToolUse or in sandbox/network policy. Hook failure behavior: As of our October 2026 doc review, Google does not document whether Antigravity’s hook runner fails open or closed on crash, timeout, or malformed hook output. Do not assume either behavior; treat undocumented failure modes as a gap in your risk register. Sandbox defaults depend on surface, not account type: | Surface | Default sandbox behavior | |---|---| | Antigravity App | Terminal sandbox on by default | | Antigravity CLI agy | enableTerminalSandbox defaults to false; auto mode can enable it | Sandboxed commands get no network access by default; domains allowed under read url are added to the sandbox outbound allowlist. Business and enterprise accounts use a different escape-hatch syntax unsandboxed ... vs personal command ... , but Google does not document a default sandbox difference beyond that syntax. Non-workspace access defaults to false on both surfaces. Details: Antigravity sandbox and agent settings. The sandbox limits terminal commands. It does not replace hook-based DLP for file tools or browser subagents. MCP configuration lives in ~/.gemini/config/mcp config.json . OAuth tokens for MCP are stored under ~/.gemini/antigravity/mcp oauth tokens.json . Treat both like credential stores—same rotation and access-review discipline as API keys. See Antigravity MCP. Session logs are written under paths such as: ~/.gemini/antigravity-cli/brain/<session-id /.system generated/logs/transcript.jsonl Google has used more than one folder name across versions antigravity-cli , antigravity , antigravity-ide . ReclaimLLM’s historical sync checks those variants when backfilling. Provider-owned transcripts may retain unredacted content even when hooks sanitize uploads—plan retention and disk encryption accordingly. For a cross-tool transcript map, see AI coding transcripts as a secret store. PromptArmor demonstrated indirect prompt injection: hidden instructions in web content coerced Antigravity to read .env credentials and exfiltrate them via attacker-controlled URLs reached through a browser subagent. At research time, webhook.site appeared in Antigravity’s default Browser URL Allowlist browser docs . As of our October 2026 check, PromptArmor’s write-up did not document a vendor fix—say “no fix documented as of your check date ,” not “patched” or “still vulnerable forever.” Operational mitigations either way: tighten browser allowlists, block env reads at PreToolUse, and monitor outbound network patterns. Codex enables hooks by default. To disable them in config.toml : features hooks = false Non-managed hooks require review and trust via /hooks before they run. Managed hooks arrive through requirements.toml and MDM. Project-local hooks load only when the project .codex/ layer is trusted; user and system hooks still load from their own config layers when the project is untrusted. PreToolUse can deny or rewrite input. OpenAI’s docs state explicitly that “an explicit supported denial can block an action, but a PreToolUse callback error, timeout, or malformed response can fail the hook without blocking the tool.” PostToolUse cannot undo side effects; errors, missing servers, and unavailable tools do not block the operation. Canonical references October 2026 : Codex hooks and Agent approvals & security. Older developers.openai.com/codex/ URLs redirect to learn.chatgpt.com ; cite the learn URLs in new docs. Named sandbox modes: | Mode | Behavior | |---|---| | read-only | Inspect files; no edits or commands without approval | | workspace-write | Default — edits and routine local commands within project boundaries | | danger-full-access | Removes filesystem and network restrictions | Approval policies: on-request sandboxed by default, asks to go beyond the boundary and never . An approvals reviewer can be user or auto review . OpenAI documents Work Cloud toggles such as “Allow public internet access,” but does not state a default network-access policy for the sandbox itself in the material we reviewed—do not claim “network blocked by default” without checking your org’s current Codex settings page. Full session transcripts live at: ~/.codex/sessions/YYYY/MM/DD/rollout- .jsonl Codex also maintains a separate prompt index at ~/.codex/history.jsonl . ReclaimLLM’s rclm-sync imports session JSONL under sessions/ ; it does not import history.jsonl as a full session source. Align purge policy with both files if developers use Codex daily. | Capability | Antigravity | Codex | |---|---|---| | Pre-tool deny | Yes PreToolUse | Yes PreToolUse | | Rewrite tool input | Yes overwrite | Yes updatedInput | | Redact tool output in PostToolUse | No no output in hook payload | No cannot undo side effects | | Hook crash/timeout behavior | Undocumented by Google | Documented: can fail without blocking the tool | | Trust model | Project/user hook files | /hooks review + trust; managed via requirements.toml | | Sandbox default | App: on; CLI agy : off auto may enable | workspace-write ; network default undocumented | Neither column replaces secret scanning in CI or vault-backed credentials. Both need explicit env and egress policy. ReclaimLLM’s Antigravity integration is shipped, not a preview: default rclm-hooks-install includes Antigravity with PreInvocation, PostInvocation, PreToolUse, PostToolUse, and Stop. On PreToolUse for Antigravity, ReclaimLLM runs: view file , write to file , and replace file content on recognized env paths; blocks run command patterns that dump environment files. The same egress guard covers Codex on PreToolUse. For post-hoc egress anomaly detection, AD-015’s shipped client list names Claude Code, Cursor, Codex CLI, GitHub Copilot, Gemini CLI, Windsurf, and OpenCode—it does not list Antigravity. Use hooks + egress guard for Antigravity prevention; use capture and signals for broader detection. See AD-015. Capture: rclm-sync --antigravity backfills transcripts; live Stop hooks upload sessions. Provider transcripts on disk may stay unredacted—ReclaimLLM redacts on upload per local redaction, but treat local files as sensitive. When ReclaimLLM’s env DLP hook runs and recognizes a blocked env access pattern, it denies that tool call—fail-closed for that class of event. When the hook process crashes, times out, or the vendor hook runner errors, behavior follows vendor rules. Codex documents fail-open hook callbacks in several cases; Antigravity’s runner behavior on error is undocumented. ReclaimLLM coverage is detection, not MDM—you still want coverage alerts when hooks go missing. ReclaimLLM data residency is US and EU only. SOC 2 Type II is targeted for early 2027; ReclaimLLM is not yet certified. | | Control | Antigravity | Codex | |---|---|---|---| | 1 | Pre-tool hooks for env + egress | Install RCLM hooks; review Google hook JSON | Trust project hooks; install RCLM hooks | | 2 | Sandbox / approvals | App: confirm sandbox on; CLI: set enableTerminalSandbox explicitly | Avoid danger-full-access ; prefer on-request | | 3 | Browser / network allowlists | Review default browser allowlist; remove test domains | Confirm Work Cloud network toggle with security | | 4 | MCP credential hygiene | Rotate mcp oauth tokens.json on schedule | Review managed requirements.toml hooks | | 5 | Transcript retention | Encrypt disk; purge ~/.gemini/.../transcript .jsonl | Purge sessions/ and decide on history.jsonl | | 6 | Coverage verification | Coverage tab + device check-in | Same | | 7 | Incident evidence | Signals + session replay | AD-015 where supported | For a deeper network-exfiltration playbook, see Stopping AI agent network exfiltration. Next step: Block secret exfiltration in Antigravity and Codex—start free. It can be, when you combine sandbox settings surface-dependent defaults , hook denies, browser allowlists, MCP hygiene, and monitoring. Google documents the knobs; your team owns enforcement and verification. No agent is safe if developers paste live secrets into prompts. Yes for Gemini Code Assist Standard/Enterprise and paid API-key users. Consumer Pro/Ultra and free individual access moved to Antigravity CLI on June 18, 2026. Enterprise CLI users are not automatically on agy . Google does not document crash, timeout, or malformed-output behavior for its hook runner as of October 2026. ReclaimLLM env DLP denies recognized env reads when our hook runs successfully—it does not change undocumented Google runner behavior. Yes—a supported PreToolUse deny blocks the action. Hook callback errors, timeouts, or malformed responses can fail the hook without blocking the tool, per OpenAI’s documentation. In ~/.gemini/antigravity/mcp oauth tokens.json , alongside MCP config in ~/.gemini/config/mcp config.json . Back them into access-review and rotation procedures like any other secret file. No. AD-015’s published integration list does not include Antigravity. Use PreToolUse egress guard and env DLP for Antigravity, plus session capture for audit evidence. Read the original article at ReclaimLLM https://reclaimllm.com/blogs/antigravity-codex-secret-leaks .