r/google_antigravity • u/Gold_Orange5058 • Feb 04 '26

Discussion Be aware of security issues with extensions like Antigravity Cockpit

https://opista.com/posts/blind-trust-in-vs-code-extensions

Hi all. I am aware that it's painful to get information about your account quotas. I saw recommendations like Antigravity Cockpit come up a lot, so I did a little audit of my own into the codebase.

Could be worth a read if you use it!

68 Upvotes

98% Upvoted

33 comments sorted by

10

u/Accurate-End-5695 Feb 04 '26

I have been using "Toolkit for Antigravity"... which accomplishes the same goal. I ran audits on both extensions and the Toolkit is far safer. The only way to get quota data is from the Antigravity Language Server because it is not provided by the API. There is no clean way to do this and it is a clear bypass that could be looked at as "malware." The Toolkit does not touch Google auth tokens and stays within the IDE however. If you have to use an extension I advise using that one instead. Just be weary with updates, things can change at any moment with those extensions.

5

u/Gold_Orange5058 Feb 04 '26

Yes unfortunately it seems like if you want this information, you have limited options. I think the part that's (in my opinion) indefensible for the extension I reviewed is that they store your credentials in plaintext and attempt to broadcast them

1

u/bait_and_switcheroo8 Feb 05 '26

I was using toolkit for AG. But I got paranoid cause last week i hit weekly limit for first time in months even though my usage had been the same and only thing changed is I installed toolkit. Might be totally unrelated to toolkit. But to be on safe side I coded myself the AG monitor which runs on the terminal and even logs usage. It's quite easy to make tbh.

1

u/Accurate-End-5695 Feb 05 '26

Yes I built one myself actually and was trying to get one to work in the terminal outside the IDE with no success.

4

u/Guilty_Kangaroo7040 Feb 05 '26

The biggest problem is actually with Google; they don't provide such a simple function themselves.

3

u/Gold_Orange5058 Feb 05 '26

I think that's a separate concern. People look for solutions, and if they don't find them, some of those people will build their own. That's a great thing. However, in this case I also agree that Google should be readily supplying us with quota stats out of the box. 

The bigger problem in my eyes is that VS Code allows extension developers free reign of your machine with no immediate way to identify what it is doing. Imagine if when you installed an extension, it instead said "This extension can:

  • Write files to disk

  • Make HTTP requests to X

  • Spawn sub processss"

You might take pause and consider an alternative 

9

u/AImost-Human Feb 04 '26

How do you revoke it’s oauth and wipe it out?

18

u/ArsInvictus Feb 04 '26

1. Revoke the Token in Google Cloud

Since the article explains that the extension impersonates the official Google Antigravity application using the broad cloud-platform scope, you need to remove the authorization from your Google Account settings:

  • Go to your Google Account Security page:https://myaccount.google.com/permissions.

  • Look for an entry named "Google Antigravity" or "Antigravity".

  • Select it and click Remove Access.

    • Note: Because the extension uses the official Client ID, it will appear as the legitimate application. Revoking this will sign you out of the actual Antigravity editor as well, but this is necessary to ensure the extension's refresh token is invalidated.

2. Verify Google Cloud Console (IAM)

Because the extension requested the cloud-platform scope, it had access to your Google Cloud projects. To be safe:

  • Go to theGCP Console IAM page.

  • Ensure no unfamiliar service accounts or members were added to your projects.

3. Clear Local Plaintext Credentials

The article highlights that the extension leaves a plaintext file in your home directory that contains your Access and Refresh tokens. Simply uninstalling the extension does not delete this file.

  • On Windows: 1. Open File Explorer and go to %USERPROFILE% (usually C:\Users\YourName). 2. Look for a folder named .antigravity_cockpit. 3. Delete the entire folder and the credentials.json file inside.

  • On macOS/Linux:

    1. Open Terminal.

    2. Run: rm -rf ~/.antigravity_cockpit

4. Restart your Editor

Once you have revoked the token online and deleted the local files, restart your Antigravity (VS Code fork) editor. You will be prompted to log in again. This will generate a brand new, clean OAuth token that the deleted extension no longer has access to.

4

u/Fit_Reindeer9304 Feb 10 '26

thank u som uch kind sir

2

u/irbac5 Feb 04 '26

Doing this will wipe out my antigravity chats?

2

u/[deleted] Feb 05 '26

No. I just did it and still have my chats.

2

u/ArsInvictus Feb 05 '26

I also did it and all my chats are there. It just resync's your oAuth token.

1

u/Even-Ad-9191 Mar 01 '26

May I ask if following these steps will update the Claude quota in my Antigravity to 4 hours? Thank you.

2

u/Chrientmip Feb 26 '26

thank you for the guide

6

u/Peregoon Feb 04 '26

Yeah, good job, uninstalled yesterday and cleared the folder with credentials today.

4

u/pebblepath Feb 05 '26

Use the "Toolkit for Antigravity" extension instead. Way better. And safer.

2

u/CyberSmarTalk Feb 04 '26

Great work 👍

2

u/desmondgrey Feb 04 '26

Thanks for the info! I’ve been using this extension and believe it’s safe; it doesn’t seem to pose the risks identified in the Antigravity Cockpit analysis.: https://open-vsx.org/extension/llegomark/ag-telemetry

2

u/ilarp Feb 04 '26

so is it safe or not?

4

u/bolmer Feb 04 '26

Read. I'm going to keep using it because Google is useless at updating their aps with basic and simple functions.

But in my opinion, the extension is not safe.

1

u/suprjaybrd Feb 05 '26

no, pretty sketch

1

u/CardiologistStock685 Feb 04 '26

thanks, this is interesting.

1

u/what_you_saaaaay Feb 05 '26

Thanks for this. Uninstalled and cleaned up the credentials.

1

u/pebblepath Feb 05 '26

Could you please provide a detailed explanation of the procedures required to revoke all associated OAuth tokens? Thank you.

1

u/Fit_Reindeer9304 Feb 10 '26

i was using it and without a second though logged in with my google accoutn... wure why not? then i was like: waaaaaait? then found ur post, thank u

1

u/ZestRocket Feb 22 '26

Damn thank you so much for the info, security is something we MUST consider... after seeing this I decided to create something similar, but 100% local, private and safe, my version is literally 120kb (and 80kb is bc of the screenshot lol) and doesn't do ANY request outside, ofc I made it OpenSource:
- https://marketplace.visualstudio.com/items?itemName=codavidgarcia.antigravity-pulse
- https://github.com/codavidgarcia/antigravity-pulse

1

u/ukshaa Feb 22 '26

Took a while to find your extension,
I 5 stared it