Google Antigravity Updates Terminal Sandbox Security
Google Antigravity has introduced updates to its terminal sandbox, enhancing security for agent-driven tasks on macOS and Linux.
Google Antigravity introduces enhanced terminal sandboxing for secure AI-driven development.
- Google Antigravity now enables terminal sandboxing by default on macOS and Linux platforms.
- The updated sandbox environment isolates shell commands, restricting filesystem access and disabling network access by default.
- Security is managed through configurable permission presets that allow users to balance automation with granular oversight.
Overview of Terminal Sandbox Enhancements
Google Antigravity has released updates to its terminal sandbox environment, focusing on providing a secure execution space for agent shell commands. The core objective of the sandbox is to isolate the operations performed by agents during project development, protecting the host workstation from unauthorized system access while maintaining the functionality required for build processes and tooling.
The updated system is currently live for users on macOS and Linux platforms, where the sandbox is enabled by default. This transition marks a shift in how command execution is handled, aiming to reduce the frequency of manual approval prompts while ensuring that agents remain confined to specific project constraints. On Windows, the platform currently maintains its legacy sandbox behavior, with plans for a future update to unify the permission system across all supported operating systems.
Technical Architecture of the Sandbox
The Antigravity sandbox utilizes native operating system primitives to avoid the overhead associated with virtual machines or containerization technologies like Docker. By leveraging these existing OS features, the system minimizes startup delays and allows for seamless integration into the development workflow.
- Linux: The implementation uses kernel namespaces to isolate the filesystem, hide host-level processes, and restrict networking capabilities.
- macOS: The sandbox relies on Seatbelt profiles (SBPL) to enforce rigorous filesystem access controls and socket connection restrictions.
By default, these environments provide sandboxed commands with access to project folders, temporary directories, and common build caches. Critical system directories such as /usr and /etc are readable to ensure that local tools function as intended. Conversely, sensitive locations such as ~/.ssh and .env files are explicitly blocked, ensuring that agent actions do not inadvertently expose user credentials or private environment configurations.
Permissions and Network Isolation
A primary security feature of the updated sandbox is its restricted network access policy. By default, shell commands running within the sandbox have no connectivity to the internet or external services. If a command requires network access, it must be explicitly configured via allowed domains, which are added to an outbound allowlist within the Antigravity permission settings.
Permission management is structured around preset configurations available under Settings → General → Permission Settings. These presets allow developers to tailor the level of automation based on their security needs:
- Default: Commands are permitted within the sandbox but require user approval if they attempt to execute outside of the sandboxed scope.
- Request Review: This setting defaults to requiring explicit human approval for all commands.
- Turbo: This setting permits command execution without manual prompting, allowing for higher levels of automation in trusted environments.
These global presets can be further overridden on a per-project basis via the Settings → Projects menu, providing flexibility for teams working across diverse project requirements.
Handling Unsandboxed Operations
The documentation acknowledges that some technical tasks necessitate operations that cannot be performed within the sandbox. For commands requiring full network access or direct interaction with host system services, the agent may request to run the operation outside of the sandbox. These requests are automatically paused for user approval unless the specific command is covered by an existing allow or deny rule. Developers can streamline these interactions by creating specific command allow rules using patterns like command(git push) or regex-based rules for complex build pipelines.
These updates reflect a continued effort to integrate AI-assisted development tools into secure environments, balancing the need for rapid iteration with the necessity of maintaining strict boundaries between AI agents and the underlying host workstation. Users are encouraged to review their existing permission configurations to ensure they align with the updated sandbox capabilities.
Enjoyed this?
Get more posts like this delivered to your inbox.
