Antigravity and Codex security: stopping secret leaks with hooks and sandboxes

Executive summary

• Side-by-side of Antigravity and Codex: where secrets leak, what each vendor’s hooks/sandbox cover, and fail-open/fail-closed behavior.
• Antigravity App sandboxes terminal commands on by default; CLI (agy) defaults sandbox off (auto-enables in auto mode). Google’s hook crash/timeout fail mode is undocumented.
• Codex sandbox modes: read-only, workspace-write (default), danger-full-access; approvals on-request / never.
• ReclaimLLM ships Antigravity hooks with env DLP and egress guard (not capture-only). Do not claim AD-015 product coverage for Antigravity.

Google Antigravity and OpenAI Codex both offer hooks that can deny a tool call before it runs, plus sandboxes or approval boundaries that limit what shell commands can do. Neither stack gives you secret protection by default: post-tool hooks cannot undo side effects, and hook failures do not always block the underlying action. For a team rolling out either agent in 2026, the practical answer is to combine pre-tool hooks, network limits, env-file controls, and session capture you can review after the fact.

This guide compares Antigravity and Codex side by side: where secrets leak, what each vendor documents, and how ReclaimLLM extends both with shipped hooks, env DLP, and an egress guard. Facts about vendor behavior were checked against public documentation in October 2026; re-verify Antigravity docs before you change production policy—they change often.

Three ways coding agents leak secrets (read, print, send)

Every coding agent faces the same three exfiltration paths, whether the model runs in the cloud or on your laptop:

1. Read — the agent opens .env, key files, or config that holds credentials.
2. Print — shell output, logs, or MCP responses echo secrets into the transcript.
3. Send — HTTP, browser navigation, or copy-to-clipboard moves data off the machine.

For a vendor-neutral map of those paths and the control layers that address them, see What is AI DLP?. The sections below focus on Antigravity and Codex specifically.

Antigravity security

Gemini CLI → Antigravity CLI (agy)

On June 18, 2026, Google announced that Gemini CLI and Gemini Code Assist IDE extensions would stop serving Google AI Pro/Ultra and free individual users. Gemini Code Assist Standard/Enterprise and paid API-key users can keep using Gemini CLI. For everyone else, Antigravity CLI (agy) is the replacement path.

Timeline note: Antigravity as an IDE existed before that cutover. Research such as PromptArmor’s exfiltration write-up and Simon Willison’s commentary (25 November 2025) predates the June 2026 consumer CLI transition—they describe Antigravity-era behavior, not the later Gemini CLI → agy migration by itself.

Hooks

Antigravity loads hooks from project .agents/hooks.json and user ~/.gemini/config/hooks.json. Documented events include SessionStart, PreToolUse, PostToolUse, PreInvocation, PostInvocation, and Stop.

On PreToolUse, decisions include allow, auto_approve, deny, ask, force_ask, and deny_unless_prior_grant, and hooks can overwrite tool input before execution. See Antigravity hooks.

PostToolUse does not receive tool output in the documented hook payload—only an error field when something failed—so post-tool hooks cannot redact what already ran. Prevention has to happen at PreToolUse or in sandbox/network policy.

Hook failure behavior: As of our October 2026 doc review, Google does not document whether Antigravity’s hook runner fails open or closed on crash, timeout, or malformed hook output. Do not assume either behavior; treat undocumented failure modes as a gap in your risk register.

Terminal sandbox

Sandbox defaults depend on surface, not account type:

| Surface | Default sandbox behavior | | --- | --- | | Antigravity App | Terminal sandbox on by default | | Antigravity CLI (agy) | enableTerminalSandbox defaults to false; auto mode can enable it |

Sandboxed commands get no network access by default; domains allowed under read_url are added to the sandbox outbound allowlist. Business and enterprise accounts use a different escape-hatch syntax (unsandboxed(...) vs personal command(...)), but Google does not document a default sandbox difference beyond that syntax. Non-workspace access defaults to false on both surfaces. Details: Antigravity sandbox and agent settings.

The sandbox limits terminal commands. It does not replace hook-based DLP for file tools or browser subagents.

MCP tokens

MCP configuration lives in ~/.gemini/config/mcp_config.json. OAuth tokens for MCP are stored under ~/.gemini/antigravity/mcp_oauth_tokens.json. Treat both like credential stores—same rotation and access-review discipline as API keys. See Antigravity MCP.

Transcripts

Session logs are written under paths such as:

~/.gemini/antigravity-cli/brain/<session-id>/.system_generated/logs/transcript.jsonl

Google has used more than one folder name across versions (antigravity-cli, antigravity, antigravity-ide). ReclaimLLM’s historical sync checks those variants when backfilling. Provider-owned transcripts may retain unredacted content even when hooks sanitize uploads—plan retention and disk encryption accordingly. For a cross-tool transcript map, see AI coding transcripts as a secret store.

Known exfiltration research

PromptArmor demonstrated indirect prompt injection: hidden instructions in web content coerced Antigravity to read .env credentials and exfiltrate them via attacker-controlled URLs reached through a browser subagent. At research time, webhook.site appeared in Antigravity’s default Browser URL Allowlist (browser docs). As of our October 2026 check, PromptArmor’s write-up did not document a vendor fix—say “no fix documented as of [your check date],” not “patched” or “still vulnerable forever.”

Operational mitigations either way: tighten browser allowlists, block env reads at PreToolUse, and monitor outbound network patterns.

Codex security

Hooks

Codex enables hooks by default. To disable them in config.toml:

[features]
hooks = false

Non-managed hooks require review and trust via /hooks before they run. Managed hooks arrive through requirements.toml and MDM. Project-local hooks load only when the project .codex/ layer is trusted; user and system hooks still load from their own config layers when the project is untrusted.

PreToolUse can deny or rewrite input. OpenAI’s docs state explicitly that “an explicit supported denial can block an action, but a PreToolUse callback error, timeout, or malformed response can fail the hook without blocking the tool.” PostToolUse cannot undo side effects; errors, missing servers, and unavailable tools do not block the operation.

Canonical references (October 2026): Codex hooks and Agent approvals & security. Older developers.openai.com/codex/* URLs redirect to learn.chatgpt.com; cite the learn URLs in new docs.

Sandbox and approvals

Named sandbox modes:

| Mode | Behavior | | --- | --- | | read-only | Inspect files; no edits or commands without approval | | workspace-write | Default — edits and routine local commands within project boundaries | | danger-full-access | Removes filesystem and network restrictions |

Approval policies: on-request (sandboxed by default, asks to go beyond the boundary) and never. An approvals_reviewer can be user or auto_review.

OpenAI documents Work Cloud toggles such as “Allow public internet access,” but does not state a default network-access policy for the sandbox itself in the material we reviewed—do not claim “network blocked by default” without checking your org’s current Codex settings page.

Transcripts

Full session transcripts live at:

~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl

Codex also maintains a separate prompt index at ~/.codex/history.jsonl. ReclaimLLM’s rclm-sync imports session JSONL under sessions/; it does not import history.jsonl as a full session source. Align purge policy with both files if developers use Codex daily.

Antigravity vs Codex: hooks and sandboxes

| Capability | Antigravity | Codex | | --- | --- | --- | | Pre-tool deny | Yes (PreToolUse) | Yes (PreToolUse) | | Rewrite tool input | Yes (overwrite) | Yes (updatedInput) | | Redact tool output in PostToolUse | No (no output in hook payload) | No (cannot undo side effects) | | Hook crash/timeout behavior | Undocumented by Google | Documented: can fail without blocking the tool | | Trust model | Project/user hook files | /hooks review + trust; managed via requirements.toml | | Sandbox default | App: on; CLI (agy): off (auto may enable) | workspace-write; network default undocumented |

Neither column replaces secret scanning in CI or vault-backed credentials. Both need explicit env and egress policy.

How ReclaimLLM fits Antigravity and Codex

ReclaimLLM’s Antigravity integration is shipped, not a preview: default rclm-hooks-install includes Antigravity with PreInvocation, PostInvocation, PreToolUse, PostToolUse, and Stop.

On PreToolUse for Antigravity, ReclaimLLM runs:

• Env DLP — denies view_file, write_to_file, and replace_file_content on recognized env paths; blocks run_command patterns that dump environment files.
• Egress guard — blocks common exfiltration binaries and inline fetch patterns toward non-allowlisted destinations, plus a GeoIP country firewall (announcement).

The same egress guard covers Codex on PreToolUse. For post-hoc egress anomaly detection, AD-015’s shipped client list names Claude Code, Cursor, Codex CLI, GitHub Copilot, Gemini CLI, Windsurf, and OpenCode—it does not list Antigravity. Use hooks + egress guard for Antigravity prevention; use capture and signals for broader detection. See AD-015.

Capture: rclm-sync --antigravity backfills transcripts; live Stop hooks upload sessions. Provider transcripts on disk may stay unredacted—ReclaimLLM redacts on upload per local redaction, but treat local files as sensitive.

Two different “fail” modes (do not conflate them)

When ReclaimLLM’s env DLP hook runs and recognizes a blocked env access pattern, it denies that tool call—fail-closed for that class of event.

When the hook process crashes, times out, or the vendor hook runner errors, behavior follows vendor rules. Codex documents fail-open hook callbacks in several cases; Antigravity’s runner behavior on error is undocumented. ReclaimLLM coverage is detection, not MDM—you still want coverage alerts when hooks go missing.

ReclaimLLM data residency is US and EU only. SOC 2 Type II is targeted for early 2027; ReclaimLLM is not yet certified.

Checklist for Antigravity and Codex

| # | Control | Antigravity | Codex | | --- | --- | --- | --- | | 1 | Pre-tool hooks for env + egress | Install RCLM hooks; review Google hook JSON | Trust project hooks; install RCLM hooks | | 2 | Sandbox / approvals | App: confirm sandbox on; CLI: set enableTerminalSandbox explicitly | Avoid danger-full-access; prefer on-request | | 3 | Browser / network allowlists | Review default browser allowlist; remove test domains | Confirm Work Cloud network toggle with security | | 4 | MCP credential hygiene | Rotate mcp_oauth_tokens.json on schedule | Review managed requirements.toml hooks | | 5 | Transcript retention | Encrypt disk; purge ~/.gemini/.../transcript*.jsonl | Purge sessions/ and decide on history.jsonl | | 6 | Coverage verification | Coverage tab + device check-in | Same | | 7 | Incident evidence | Signals + session replay | AD-015 where supported |

For a deeper network-exfiltration playbook, see Stopping AI agent network exfiltration.

Next step: Block secret exfiltration in Antigravity and Codex—start free.

FAQ

Is Google Antigravity secure for company code?

It can be, when you combine sandbox settings (surface-dependent defaults), hook denies, browser allowlists, MCP hygiene, and monitoring. Google documents the knobs; your team owns enforcement and verification. No agent is safe if developers paste live secrets into prompts.

Is Gemini CLI still available?

Yes for Gemini Code Assist Standard/Enterprise and paid API-key users. Consumer Pro/Ultra and free individual access moved to Antigravity CLI on June 18, 2026. Enterprise CLI users are not automatically on agy.

Do Antigravity hooks fail open?

Google does not document crash, timeout, or malformed-output behavior for its hook runner as of October 2026. ReclaimLLM env DLP denies recognized env reads when our hook runs successfully—it does not change undocumented Google runner behavior.

Can Codex hooks block a command?

Yes—a supported PreToolUse deny blocks the action. Hook callback errors, timeouts, or malformed responses can fail the hook without blocking the tool, per OpenAI’s documentation.

Where are Antigravity MCP OAuth tokens stored?

In ~/.gemini/antigravity/mcp_oauth_tokens.json, alongside MCP config in ~/.gemini/config/mcp_config.json. Back them into access-review and rotation procedures like any other secret file.

Does ReclaimLLM’s AD-015 cover Antigravity?

No. AD-015’s published integration list does not include Antigravity. Use PreToolUse egress guard and env DLP for Antigravity, plus session capture for audit evidence.