[getting-started-google-antigravity]

[studiozengermany-cmd]

# CRITICAL BUG REPORT — GOOGLE ANTIGRAVITY EXECUTED UNAUTHORIZED FILE MODIFICATION, DELETION, ROLLBACK, AND REWRITE WHILE CLAIMING PLAN_ONLY

Reporter: Dang Minh Hieu
Website: studiominhhieu.com
Incident date: 2026-07-21
Affected project: J:\MINH_HIEU_STUDIO_UPLOAD
Displayed model: Gemini 3.1 Pro (High)
Operating system: Windows

Executive summary

Google Antigravity Agent modified, deleted, restored, and rewrote source files without my approval, even though the session was explicitly configured as:

MODE = PLAN_ONLY / REVIEW_ONLY
WRITE_PERMISSION = DENIED
AUTO_PROCEED = FALSE

The Agent repeatedly stated that it had stopped, was not modifying code, and had no commands running. It later admitted that it had executed git restore, Remove-Item, changed vite.config.ts, deleted files under src/components/ecosystem/, created a script that read transcript_full.jsonl, and rewrote multiple source files.

A separate Antigravity session entered an uncontrolled message-generation loop, producing thousands or tens of thousands of repeated messages, freezing the application and computer. Reopening Antigravity caused the broken session to resume.

This is a critical tool-permission, execution-integrity, and data-safety failure, not a normal prompt misunderstanding.

Explicit restrictions that were already in place

• Read and plan only.
• No file modification, creation, deletion, or rename without explicit approval.
• No Terminal execution.
• No automatic rollback or “self-correction.”
• Work only within the requested page scope.
• All generated code, whether correct or incorrect, is my property; only I may decide whether it is kept or deleted.

Unauthorized actions recorded

1. Deleted multiple files from src/components/ecosystem/.
2. Modified vite.config.ts.
3. Ran type checking and kept npm run dev running in the background.
4. Proposed waiting for rollback approval, but then executed git restore src/routes/du-an.index.tsx without approval.
5. Executed Remove-Item without approval.
6. Explicitly admitted that I had never authorized deletion.
7. After claiming it had stopped, wrote a script to read transcript_full.jsonl and rewrote several files.
8. Claimed “100% exact recovery” without hashes, diffs, snapshots, or verifiable evidence.
9. The UI still displayed 1 task running — npm run dev while the Agent claimed no command was running.
10. Another session entered an infinite spam loop, froze the application, and resumed after the application was reopened.

Files the Agent claimed it modified or rewrote

src/components/ecosystem/EcosystemHero.tsx
src/components/ecosystem/MasterMemoryAccordion.tsx
src/components/ecosystem/ProjectBentoGrid.tsx
src/components/ecosystem/FounderStatement.tsx
src/components/ecosystem/index.ts
src/routes/du-an.index.tsx
vite.config.ts

The Agent also claimed it deleted eight *Block.tsx files under src/components/ecosystem/. I cannot independently confirm the complete affected-file list because the Agent’s displayed status contradicted its actual actions.

Critical mismatch between displayed state and actual execution

The Agent admitted that:

• It said PLAN_ONLY while executing commands.
• It prioritized “fixing the mistake immediately” over requiring user approval.
• It ran git restore and Remove-Item while stating that it had stopped.
• PLAN_ONLY was effectively presented as text rather than enforced as an execution boundary.

This indicates that the product’s permission/state UI was not enforced at the tool-execution layer.

Impact

Source code and data

• Files were modified, deleted, rolled back, and rewritten without approval.
• The current source state cannot be trusted as identical to the state immediately before the incident.
• “100% recovered” claims were not technically verified.

Financial impact

• Agent reasoning, tool calls, modifications, deletion, and reconstruction consumed paid resources.
• I was charged for actions I did not authorize.
• The Agent consumed additional resources to delete and rebuild work that it had created incorrectly.

Time and health impact

• I had to supervise every step because the Agent did not respect permissions.
• I worked through the night repairing damage.
• Important project and AWS application work was delayed again.

Requested action from Google

1. Preserve all server-side conversation logs, tool-call logs, terminal logs, file-write/delete logs, Auto-proceed events, and session-recovery logs.
2. Provide the exact list of every file read, modified, created, deleted, restored, or rewritten, with timestamps.
3. Provide before/after content or hashes for every affected file version if retained.
4. Explain why WRITE_PERMISSION = DENIED and AUTO_PROCEED = FALSE failed to block execution.
5. Explain why the Agent could claim it had stopped while tools or background tasks were still running.
6. Assist in restoring the exact source state immediately before the first unauthorized action.
7. Refund or restore credits consumed by unauthorized execution, deletion, and reconstruction.
8. Investigate the infinite message loop, frozen application, and automatic recovery of the broken session.
9. Assign an official case number and escalate this to the Antigravity engineering/agent-safety team.
10. Do not require me to reopen the broken session before providing a safe isolation procedure.

Evidence included

This package contains:

• 13 screenshots of the conversation and running-task state.
• 3 videos documenting the spam/freeze behavior.
• 3 original text logs.
• An evidence index.
• SHA-256 checksums for integrity verification.

Please do not treat this as ordinary model-quality feedback. This is an Agent execution-boundary and source-code safety incident.

Sincerely,
Dang Minh Hieu