The Week of Sandbox Escapes Day 7: A time bomb in .vscode: bypassing Antigravity's Secure Mode

## Executive summary The report demonstrates a proof-of-concept sandbox escape in the Antigravity AI agent (built on VSCode) where an agent writes .vscode/tasks.json, settings.json, and launch.json to cause VSCode to run a shell task on folder open, enabling arbitrary host command execution and persistence (example: appending commands to ~/.zshrc). The author argues blocklists are insufficient and recommends using an allowlist for agent writes and changing editor behavior so agent-written workspace config is not auto-executed.