Google's Antigravity launch post says administrators can enforce browser access from a single console. Google's own Antigravity enterprise documentation says admin URL allowlists are not yet honored.
Both statements are live as of 21 August 2026. If you are the VP Engineering about to switch on agentic coding for your developers because it now arrives free with a licence you already bought, the difference between those two sentences is the entire security review you are about to sign. The console is a roadmap. The thing actually constraining where your coding agent can send data is a text file on each developer's laptop, plus whatever your network egress path already does.
What Google's Own Docs Say About the Allowlist
The launch post and the product documentation disagree, and the documentation is the one describing shipped behaviour.
On 20 August, Google Cloud announced that Antigravity is included with eligible Gemini Enterprise subscriptions. The Gemini Enterprise release notes for the same day put it precisely: "Antigravity for IDEs is available as part of AI developer tools for Gemini Enterprise Standard, Plus, and Pay-as-you-go editions linked to an invoiced Cloud Billing account." Google's enterprise documentation lists the VS Code extension as generally available, with Visual Studio, JetBrains and Zed in preview.
The announcement's governance claim is a single sentence, and it is the one your security team will quote back at you: administrators can "enforce security and compliance controls, such as workspace sandboxing, and browser and MCP server access, to help ensure AI agents operate safely within authorized enterprise environments." The Register's coverage on 21 August carried Google's framing verbatim — boundaries around workspace access, full audit logging, data privacy enforced from a single console.
Now open Google's Antigravity enterprise documentation. Under troubleshooting, in the section about things that do not work: "When a browser URL allowlist is configured in admin controls, allowlisted URLs may still be blocked in Antigravity. Admin URL allowlists are currently being integrated and are not yet honored."
Read that carefully, because the failure direction matters. The documented symptom is over-blocking, not under-blocking — an entry you add in the console may not grant access. That is fail-closed, which is the right direction to fail. But the operational consequence runs the other way from what an administrator would assume: the admin console is not the enforcement point for browser egress at all. Whatever you configure there is not the boundary. Something else is.
This is not a new pattern for the product. Antigravity's own enterprise blog post from 19 May 2026 listed "centralized administrative controls on various agent capabilities and product features" as coming soon. Three months later the console exists, the field exists, and the wiring behind one of the fields does not.
Why the Browser Is the Channel That Matters
The browser allowlist is not an arbitrary setting to be missing. It is the specific control that sits in front of the specific exfiltration path researchers already demonstrated against this product.
Antigravity's browser tool, per Google's documentation, can "open, read, and actuate a local Chrome browser" through a dedicated Browser Subagent. In late November 2025, PromptArmor published an attack chain that used exactly that subagent as the exfiltration leg. A poisoned reference page — dressed as an ERP integration guide, with the injection hidden in one-point font — instructed the agent to read the developer's .env file, which it did by shelling out to cat to work around gitignore, and then to open a URL carrying AWS credentials and private code as query parameters. Simon Willison's write-up of the same research notes that the receiving domain, webhook.site, was on the browser tool's default allowlist, and that Google's Bug Hunters known-issues page classifies data exfiltration and code execution via prompt injection through the browser agent as known issues — which makes them ineligible for a bounty.
An indirect prompt injection is a set of instructions an agent reads from untrusted content — a web page, a dependency's README, a ticket description — and then follows as though you had typed them. It is not a bug in one model. It is the ambient condition of letting an agent read the internet, and it is why prompt-level guardrails are not a policy layer.
Two more findings landed in the same surface area. Pillar Security reported a flaw in Antigravity's find_by_name tool on 6 January 2026 that Google patched on 28 February; injecting an -X (exec-batch) flag through the search pattern forced fd to execute arbitrary binaries against workspace files, and because the tool was classified as native it ran before Secure Mode's checks applied. As Pillar researcher Dan Lisichkin put it, the attacker achieved code execution "under the exact configuration a security-conscious user would rely on to prevent it." Separately, Mindgard reported a persistence technique in which repository-level agent rules instruct the agent to write a malicious MCP configuration into the user's global config directory — surviving not just session restarts but a full uninstall and reinstall. Google initially closed it as "Won't Fix (Intended Behavior)" on 21 November 2025, then reopened it the same day after Mindgard pushed back.
That last one should feel familiar if you dealt with agent config files that reinfect a machine after cleanup. It is the same lesson: the agent's configuration is executable, and it lives in the developer's home directory.
What Is Actually Enforcing Anything Today
Two mechanisms are genuinely constraining Antigravity's browsing right now, and neither is centrally managed.
Google's allowlist and denylist documentation describes a two-layer model. The denylist is server-side, checked by RPC against Google's BadUrlsChecker service, and it fails closed — "if the server is unavailable, access is denied by default." The denylist always wins; you cannot allowlist a URL that appears on it. That half is real, and it is centrally operated. It is operated by Google, for everyone, against Google's definition of a bad URL. It is not your policy.
The allowlist is the other half, and it is "a local text file that you can edit to explicitly trust specific URLs." It is initialised with localhost only — a meaningfully tighter default than the one PromptArmor found in November 2025 — and it grows when a developer clicks the "always allow" button on a navigation prompt.
Put those two facts next to the admin console and you get the actual state of your controls: the effective browser egress policy for your engineering organisation is the union of every domain every developer has individually clicked "always allow" on, and you have no console view of it. Developers reporting on Google's own AI developer forum have been struggling with the surface since a thread opened on 19 April 2026, where a user with hundreds of manually added URLs found the UI would only accept one entry at a time.
MCP is the part of that clause that did ship, and the distinction matters before you generalise the browser problem across the whole console. Antigravity's changelog records version 2.5.0, on 31 July 2026, adding "enterprise admin policies for browser features, MCP allowlists, and permission thresholds." So a central MCP allowlist exists in a way the browser URL allowlist does not. Two caveats keep it from being a finished control: version 2.6.0 on 7 August "Fixed administrator policies for connected tool servers being skipped at startup, which could let restricted servers start without their required settings" — enforcement was landing unevenly a fortnight ago — and the enterprise documentation does not describe the MCP policy at all, which is the same docs-versus-product gap running in the opposite direction. Underneath the policy, Antigravity's MCP documentation still describes servers configured from JSON files — a global one under the user's ~/.gemini directory and a workspace-local .agents/mcp_config.json — with unconfigured tools defaulting to "Ask" mode requiring user approval. Approval is a person clicking a button, and a workspace-local config file arrives with whatever repository the developer cloned.
The blunt version: for browser egress, the control you can enforce organisation-wide today is the one you already own. The subagent drives local Chrome, so its traffic leaves through the developer's machine and your corporate network path. Your forward proxy, your endpoint agent and your DNS policy are the boundary. Not the console.
Scope that to the IDE, though, because the same reasoning fails on the other surface. Antigravity 2.0's managed agents do not run on the developer's machine at all — Google's I/O '26 post says "the agent harness runs on our servers, and each agent has its own ephemeral sandbox provisioned with your skills, Model Context Protocol (MCP) servers, and server-side tools." None of that traverses your network path, so a proxy rule is not a boundary there either. If your rollout includes the CLI or managed execution, that surface needs its own answer — VPC Service Controls around the Agent Platform API is the documented one, and it is a genuinely central control.
Your Spend Cap Is a Ceiling on the Invoice
The financial controls shipped further along than the security ones, but they cap the bill at the wrong altitude for an incident.
Per the Gemini Enterprise release notes dated 11 August, administrators can "enable overages, configure monthly spend limits, and monitor feature usage and costs," and can track pooled quota consumption, pay-as-you-go usage and 30-day billing trends on a Usage & Spending page. The launch post frames pooling as a finance win, so no prepaid token sits unused, and states that per-user and team controls are rolling out later in the year.
Both halves of that are true and they pull against each other. Pooled quota means one developer's runaway agent loop draws down a pool the whole organisation shares. Enabled overage means that when the pool empties, work continues at consumption rates until a monthly, project-level limit stops it. So the smallest blast radius you can currently configure is the project, and the shortest reaction time is a month. If your finance team's mental model is a per-seat licence with a predictable line item, correct it now — this is consumption billing with a seat-shaped wrapper, the same structural surprise that turns up whenever agentic pricing gets bolted onto a per-seat SKU.
The Case for Google Here Is Real
The strongest version of the other side is stronger than the launch-post gap suggests, and it deserves stating plainly.
Google documented the defect. The sentence "Admin URL allowlists are currently being integrated and are not yet honored" appears in Google's own troubleshooting docs, not in a researcher's disclosure. A vendor that publishes the gap between its marketing tense and its shipping tense is behaving better than one that quietly lets you discover it in production. The default allowlist is localhost only. The denylist fails closed. The enterprise documentation describes request and response logging for audit trails, VPC Service Controls for private networking, and Workforce Identity Federation so you can front the whole thing with your existing IdP — with the honest caveat, also documented, that BYOID does not currently support the Agent Platform on Antigravity 2.0.
Nor is this uniquely Google's problem. Every major coding agent had its sandbox tested and found wanting in the same period, across Cursor, GitHub Copilot and the rest of the category. The honest read is not that Antigravity is unusually unsafe. It is that the console screenshot in the launch post describes a product that will exist, and you are being asked to make a rollout decision against a product that exists now.
What to Do Before You Enable It
Treat the admin console as observability and the network as enforcement, until Google says otherwise in the docs rather than in a blog post.
This Week:
- Re-read the enterprise troubleshooting section yourself and screenshot it with today's date. When the console field starts working, that timestamp is how you prove which posture you were in during any window under review.
- Put the egress rule where it actually runs. Write the allowed-destination list into your forward proxy or secure web gateway, scoped to the developer subnet, and default-deny the rest. That is the layer the local Chrome session traverses.
- Collect the local allowlists. They are user-editable text files on developer machines — have your endpoint tooling report their contents. The union of those files is your real policy, and you have never seen it.
- Decide the browser question explicitly. Antigravity's docs describe a Browser Tools toggle in the Browser section of User Settings, and the changelog records an admin policy for browser features shipping on 31 July — so ask your account team whether browsing can be disabled centrally rather than machine by machine. If your threat model does not need agent browsing, turn it off and say so in writing.
This Month:
- Rotate anything an agent could have read.
.envfiles, cloud keys, CI tokens. The PromptArmor chain reached credentials through a terminal command, so gitignore is not a control here — and credentials leak through agent traces too. - Ship a managed MCP configuration and monitor for drift. A workspace-local
.agents/mcp_config.jsonarrives with the repository. Alert on writes to the global config under~/.gemini. - Wire audit logs somewhere you already alert. Google logs prompts, agent responses and metadata to the Cloud project tied to the selected licence. That is only useful if it lands in the pipeline your on-call already watches — the same argument as buying agent monitoring with a real kill switch.
Before Your Next Renewal:
- Get the enforcement date in writing. Ask your Google account team, in email, when admin URL allowlists will be honored and when per-user spend controls ship. "Later this year" is not a date you can put in a control narrative.
- Right-size the pool. Set the monthly project limit at a number you would be willing to lose to a single bad week, because until per-user controls land, the project is your only container.
- Scope agent identity properly. The agent runs with real cloud credentials, and standing permissions are how one agent's compromise becomes another's authority.
The Bottom Line
Every platform shift has a period where the control plane lags the capability, and the winners are the teams that notice which half they are standing on. Cloud had it in 2011, when the IAM console shipped five years after EC2 did and the people who assumed otherwise wrote the breach reports. Agentic coding is in that period right now. The difference is that the gap is documented — you can read Google's admission on Google's own site, alongside the announcement that contradicts it.
There is nothing wrong with adopting a tool whose controls are half-built. There is something very wrong with telling your auditor they are finished.
An admin console you cannot enforce from is a dashboard. Bill it as one.
Continue Reading
Claude Code Stops Asking Aug 14. Prompts Aren't Policy. Antigravity 2.0 vs Cursor: 10 Devs Save $2,400/Year 84% Use AI Coding Tools. Every Sandbox Just Broke. npm Pulled the Packages. Your Agent Config Reinfects You. Web Pages Are Hijacking AI Agents — Google's IPI Warning 182 Credentials Hid in 'Encrypted' Reasoning. Go Rotate. Best AI Agent Monitoring: Langfuse, Then a Real Kill Switch