Evidence record / antigravity
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the signals and issues that cite it, below.
2026-08-10-antigravity-1-1-11-discloses-that-a-malformed-allowlist-entry-auto-approved-every
1.1.11 discloses that a malformed allowlist entry auto-approved every command.
The 1.1.11 changelog states: 'Fixed an allowlist entry that tokenizes to zero command words -- command(time), a comment-only entry, or an empty compound such as () -- matching every command and silently auto-approving anything the agent ran; such an entry now matches nothing.' Class: permission/authorization bypass. Per the vendor's own permissions doc, command rules match by whitespace-separated token prefix; an entry that tokenizes to zero words therefore matched the empty prefix, i.e. everything. A second entry in the same release, 'Fixed commands being auto-approved while the session was in request-review or strict permission mode', says the two strictest modes were independently not binding.
Channel: tagged-release. Ancestry: gh api repos/google-antigravity/antigravity-cli/releases/tags/1.1.11 returns prerelease:false, draft:false, target_commitish:main, published_at 2026-08-07T02:35:23Z. gh api .../git/ref/tags/1.1.11 resolves to commit 1d853acd23f2b0fc55da42377aab1a05f5e34aa8, which is on main (listed by the commits API for the window). CHANGELOG.md fetched at that pinned SHA has '## 1.1.11' as its top section and the entry verbatim. CAVEAT ON ANCESTRY: the repo tree at fbf22703 contains only .github, CHANGELOG.md, README.md, agy-cli-demo.gif and examples; /languages returns {} and /license returns 404. Ancestry here proves when the changelog commit landed, not that any binary derives from it.
Operator consequence: Upgrade to 1.1.11 or later, then re-audit every permission.allow list you have ever written for entries that tokenize to zero command words -- a stray comment line, an empty (), or a bare command(time)-shaped entry. On any version before 2026-08-07, treat a session that carried such an entry as having run with no command gate at all, and treat request-review and strict mode on those versions as advisory rather than enforcing. Read agent transcripts from that period rather than assuming the prompt log is complete.
Receipt
Finding metadata
Run: 2026-08-10-weekly-digest-2026-08-03_2026-08-10-frontier-v0
Finding ID: 2026-08-10-antigravity-1-1-11-discloses-that-a-malformed-allowlist-entry-auto-approved-every
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact