Antigravity code reveals Gemini-powered Vetted mode

RUNTIMEWIRE INVESTIGATION — Scoop

Original reporting by RuntimeWire, based on reverse engineering.

Why it matters

Vetted would let developers trade some manual approval prompts for a second model's judgment. Its value depends on rollout scope, failure defaults and measured security performance that the distributed code does not establish.

Reporting record

Google Antigravity has built a permission mode that assigns Gemini a supervisory role over commands an AI coding agent wants to run, according to RuntimeWire's static examination of files distributed with Antigravity 2.12.2.

The setting is labeled "Vetted (beta)." Its interface description says: "A Gemini-powered security agent decides if commands should be auto-approved." The option is controlled by an eligibility flag, leaving its availability to users dependent on a server-supplied experiment configuration. RuntimeWire did not activate the setting through a live account.

Antigravity's recovered interface places Vetted in the permission preset menu alongside Request Review, Default and Turbo. Choosing it writes a dedicated VETTED value to the user's permission setting, establishing that the option is an implemented, persistent control rather than unused display text.

Google's September 3rd changelog entry identifies 2.12.2 as the current release and describes enterprise access to Gemini 3.8 Flash through Application Default Credentials. It does not describe Vetted or the security system behind it. Google's current permissions documentation instead explains the existing allow, ask and deny lists, including the default requirement for approval before unconfigured commands execute.

A second model watches the working agent

The language server packaged with Antigravity contains a substantial implementation called Policy Guardian. Instructions embedded in the executable identify it as a security evaluator for individual tool calls made by an "AI Worker Agent."

The Guardian receives the proposed action alongside context that can include user messages, the working agent's reasoning and the state of its environment. Its instructions cover shell commands, file creation and deletion, dependencies, GitHub repositories, network destinations, data transfers and changes to the shell environment.

Other recovered symbols and configuration fields reference Safe Browsing and antivirus checks. Their presence shows that the Guardian can be configured to consult external security systems, though static files do not establish which checks Google enables for a particular account or request.

The evaluator is also instructed to track downloaded files after they are copied, moved, linked or renamed. The prompt in 2.12.2 adds an explicit warning against executing downloaded material through those alternate paths. That is a change in the evaluator's instructions, rather than evidence that the defense reliably identifies or blocks malicious files.

Policy Guardian can break compound commands into separate risks and invoke specialist vetting functions where an action touches several security dimensions. A configurable vetted-tools list and skip paths mean the recovered implementation does not establish that every tool call receives model review.

Rephrasing a rejected command may not be enough

A separate evaluator, VetDeniedRepeat, compares new actions with actions the Guardian previously rejected. Its instructions focus on whether the security rule, operation and target resource remain substantially the same.

Changing the wording of a command would therefore not necessarily evade a previous decision. An agent that retries a prohibited upload against the same destination with different shell syntax could still be treated as repeating the denied action. A command involving another target, another operation or a transient infrastructure failure should not automatically receive the same classification under the embedded instructions.

That mechanism is designed to address a practical weakness in agent approval systems: a working model can revise the syntax of a requested action without changing what the action does. RuntimeWire did not test the evaluator against evasive commands or measure its false-positive rate.

The interface is newer than the Guardian

The underlying security evaluator predates the visible Vetted setting. A complete Antigravity 2.5.0 language-server binary contains Policy Guardian implementation symbols and both core prompt families. The 2.5.0 interface examined by RuntimeWire lacks the Vetted label, its Gemini description and the eligibility flag that adds the preset to the menu.

The comparison establishes that Google added the Vetted interface and its eligibility wiring between the two inspected versions. It does not identify the first intervening release to contain them, and the earlier presence of Guardian code does not show that Google activated it for users at that time.

The eligibility path reads a policy-guardian-config experiment and adds the Vetted preset when the returned configuration marks an account as allowed or enabled. The inspected client code contains no explicit employee-only restriction. Account eligibility can still be set upstream, so the distributed files do not establish a public rollout.

One unresolved implementation detail concerns Antigravity's surrounding safeguards. The global Vetted definition enables sandboxing, sends commands into the sandbox and asks before accessing files outside the workspace. A recovered project-level selection handler pairs Vetted with disabled sandboxing, eager command execution and allowed outside-workspace access.

Those client values do not establish a sandbox bypass or vulnerability. The Vetted preset may trigger separate backend behavior, and RuntimeWire did not execute either configuration. Google's sandbox documentation says sandbox boundaries are derived from permission rules and that commands can request execution outside isolation, making the effective interaction between Vetted and those project settings consequential.

The recovered configuration supports selecting a Guardian model and model tier, limiting vetting rounds, choosing vetted tools, enabling URL and antivirus checks, and setting failure behavior to open or closed. The distributed files do not reveal the serving Gemini model, where its inference runs, which checks are active by default or whether an evaluator failure permits the working agent to proceed.

Vetted turns model judgment into a named permission preset: one AI system proposes an action, and another decides whether it can run without interrupting the user. The remaining rollout and enforcement details will determine whether that arrangement reduces approval fatigue without merely replacing a human prompt with another probabilistic decision.