The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Is Google Antigravity safe for private code? It can be configured to limit what an agent does on your computer, but those local controls do not prove that private code stays on-device or define consumer-plan retention and model-training practices. The answer depends on your account and deployment, operating system, Antigravity version, permission preset, enabled tools, and threat model.
For a sensitive repository, use the most restrictive mode available, approve access requests individually, deny secrets and unrelated directories, constrain commands, URLs, and MCP tools, and verify how your organization’s account handles prompts and code. Google documents a separate Gemini Enterprise/Google Cloud route with stronger governance claims; confirm that your team is actually using that route and that its project, region, logging, and contract match your requirements.
As an Amazon Associate I earn from qualifying purchases.
What “safe for private code” has to answer
Security and privacy are separate questions in an agentic development environment. First, what can the agent read, change, execute, or reach on your computer? Second, what code or context is sent to Google or another selected model provider, how long it is retained, who can access logs, and whether it is used to improve services?
Recommended Free Tools
Antigravity’s permission system addresses the first question. It represents sensitive actions as permission resources such as file paths, commands, URL domains, and MCP tools. A rule can deny an action, pause and ask you, or allow it without prompting. The settings page and enterprise documentation address aspects of the second question, but the consumer documentation does not fully establish prompt/code retention, model-training use, or whether disabling telemetry changes inference processing.
#1 Best Overall
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
That means a local sandbox is not a promise that code never leaves the machine. Conversely, a request for model processing does not automatically mean the agent has unrestricted local authority. Evaluate both layers before putting proprietary source, credentials, regulated data, or production access in a workspace.
How Antigravity permission rules work
Google documents three outcomes for an action:
- Deny blocks the action.
- Ask pauses the agent and requires your approval.
- Allow permits the action without an approval prompt.
Conflicts are resolved in this order: Deny takes priority over Ask, and Ask takes priority over Allow. Therefore, a specific deny rule can narrow a broad allow rule, while a wildcard allow can materially widen access. Review the target and scope of every rule rather than assuming that a preset is automatically least privilege. The complete resource types and precedence rules are documented in Google’s agent permissions documentation.
What the resources cover
Permission resources include file reads and writes, terminal commands, unsandboxed execution, URL reads, interactive browser actions, and MCP tools. MCP rules apply to local and remote MCP servers according to the documentation. A rule for a directory, command pattern, domain, or tool can therefore affect more than the single operation you had in mind; inspect wildcard patterns and inherited scope.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Preset behavior on macOS and Linux
Google’s updated permission engine is documented for macOS and Linux. The three presets have materially different authority:
| Preset | Sandbox | Terminal behavior | Files, browser, and MCP behavior |
|---|---|---|---|
| Default | Enabled | Commands run inside the sandbox; commands requiring outside access prompt unless an allow rule covers them. | Workspace and temporary directories are available. MCP and web access ask. |
| Request Review | Disabled | Commands always require approval. | Workspace access is available; MCP and web access ask. |
| Turbo | Disabled | Commands are unrestricted. | Full filesystem access; MCP and web actions are allowed. |
The settings documentation also describes Default as permitting read/write access to the workspace and temporary directories while requiring approval for anything else. “Request Review” removes the terminal sandbox but compensates with an approval gate for every command, so it is not automatically safer in every threat model. Turbo is the least restrictive choice and is inappropriate for a repository containing secrets or high-impact credentials.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Windows is different
Windows continues to use the previous permission system, while the updated system described above is available on macOS and Linux. Names and controls from one platform should not be assumed to exist on another. Check the installed version’s active settings and the Windows-specific documentation before making a security decision. The agent settings page describes the available controls.
Which permission mode is safest?
There is no universal safest preset because the trade-off is isolation versus supervision. For macOS or Linux, start with the most restrictive mode that still supports the task:
- Use Default when you want a terminal sandbox and workspace/temp access, with approval for operations outside that scope.
- Use Request Review when command-by-command approval is more important than terminal isolation. Read every proposed command; an approval prompt is not a substitute for understanding what the command does.
- Avoid Turbo for private or regulated code. It removes isolation, permits unrestricted commands, exposes the full filesystem, and allows MCP and web actions.
On Windows, select the tightest available equivalent in the older system and verify how it handles terminal, filesystem, browser, and MCP requests. Record the exact Antigravity release and operating system in your team’s security notes; a mode name alone is not a portable control description.
Can Antigravity read files outside my workspace?
It depends on the active preset and rules. Under macOS/Linux Default, workspace and temporary-directory access is available, while other paths should require approval unless an allow rule covers them. Request Review limits documented file access to the workspace while still asking for MCP and web access. Turbo grants full filesystem access.
These are capabilities, not proof that every file will be read. The agent still needs a task that causes a read, and a rule may deny it. However, an allow rule for a broad directory or wildcard can make unrelated files reachable without another prompt. Deny sensitive locations explicitly where the product permits it, and keep secrets outside the repository and workspace whenever practical.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Directories and files worth denying
- Credential stores, SSH keys, cloud-provider configuration, signing keys, and password-manager exports.
- Unrelated repositories and personal documents mounted on the same machine.
- Production configuration, deployment manifests, and databases that are not required for the task.
- Generated artifacts containing customer data or regulated records.
Also review temporary directories. Default includes temporary-directory access, so a secret copied there by another process may be in scope even if it is not under the project root.
Free tools Windows power users keep installed
One-click scans. No signup required.
Does Antigravity send my code to Google?
Local permissions cannot answer that question. To produce a model response, Antigravity may need to send selected prompts, file context, tool output, or other interaction data to a model service, but the consumer documentation cited here does not fully specify what is retained, for how long, or whether those materials are used for model or product improvement. Do not infer an on-device guarantee from a sandbox, and do not infer a complete no-training guarantee from turning off a local setting.
Google’s settings documentation says that when Enable Telemetry is on, Antigravity collects interactions for evaluating, developing, and improving Antigravity and supporting models. The documented description does not establish the complete contents of interaction data, consumer retention periods, or the relationship between telemetry collection and model-inference requests. Telemetry off should therefore be treated as a narrower choice about documented telemetry, not as proof that no code or prompt data is processed remotely.
What Google’s terms require from you
The Google Antigravity Terms of Service place responsibility on the user. They state: “You are solely responsible for: (a) the actions and tasks performed by an AI Agent; (b) determining whether the use an AI Agent is fit for its use case; (c) authorizing an AI Agent’s access and connection to data, applications, and systems; and (d) exercising judgment and supervision when and if an AI Agent is used in production environments to avoid any potential harm the AI Agent may cause.”
For a business, that means your review must include contractual and organizational controls, not only a local toggle. Ask which account type is in use, what terms govern it, what logs administrators can access, where processing occurs, and whether your compliance team has approved the service for the repository’s data classification.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
What does Antigravity’s telemetry setting collect?
The documented label is Enable Telemetry. When enabled, Google says Antigravity collects interactions to evaluate, develop, and improve Antigravity and supporting models. The statement is intentionally broader than a crash-report description, so treat interaction content as potentially sensitive.
The available documentation does not provide a complete field-by-field inventory, consumer retention schedule, or a definitive statement that disabling telemetry blocks every inference-related transfer. Before enabling the product on confidential code, document the setting your organization permits, check the current policy text in the installed release, and obtain a written decision from security or privacy staff. If telemetry is not needed for your workflow, leave it disabled, but do not represent that choice as an air-gap.
Consumer use versus Google Cloud/Gemini Enterprise
Google documents a separate enterprise route through Gemini Enterprise and Google Cloud. It is governed by Google Cloud terms and offers organization controls and data-residency options. Google’s enterprise documentation states: “Enterprise prompts, responses, code, and telemetry are never stored outside your private environments.” That is a Google product statement for that deployment, not an independent audit and not a property of every consumer sign-in.
| Decision area | Consumer Antigravity account | Documented Google Cloud/Gemini Enterprise route |
|---|---|---|
| Account and contract | Consumer or otherwise non-enterprise terms; verify the account actually used. | Google Cloud terms and organization-managed deployment. |
| Prompt, code, and telemetry governance | Publicly documented pages do not fully establish consumer retention or training use. | Google states enterprise prompts, responses, code, and telemetry are never stored outside private environments. |
| Data residency | Do not assume a residency choice from local permission settings. | Enterprise documentation describes data-residency controls; confirm the selected region and project. |
| Local authority | Still determined by Antigravity’s OS-specific permission engine, preset, and rules. | Enterprise governance does not remove the need to configure local permissions. |
| Validation needed | Read the current consumer terms and settings for the exact account and release. | Verify project, region, logging, administrator access, contract, and that requests are routed through the approved enterprise deployment. |
Do not call a setup “enterprise” merely because a developer works for a company or uses a paid Google account. Confirm the identity provider, billing project, organization policy, region, and endpoint documented by your administrator. Google’s overview is available at Antigravity Enterprise and its announcement at Google Antigravity in Gemini Enterprise.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesSecurity history: what the 2026 vulnerability report means
A Cloud Security Alliance note dated April 22, 2026 describes two responsibly disclosed Antigravity issues. It says the issues were patched by February 28, 2026 and recognized through Google’s Vulnerability Reward Program. The attack classes involved native-tool privilege bypass and startup-configuration abuse. Read the chronology as evidence that specific reports were addressed, not as a current certification.
Best Value
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The note does not provide a live fixed-version matrix, and it does not show that every current release is unaffected or that prompt-injection attacks are eliminated. Keep Antigravity updated, review release and security advisories, and treat repository files, dependencies, issue text, and web pages as potentially hostile instructions. The report is available from the Cloud Security Alliance.
A practical hardening procedure for private repositories
- Classify the code and credentials. Decide whether the repository contains trade secrets, personal data, regulated material, signing keys, production credentials, or customer exports. If policy forbids sending that class of data to an unapproved model service, stop and obtain an approved deployment before opening the repository.
- Identify the platform and release. Record whether the machine runs macOS, Linux, or Windows and the exact Antigravity version. Do not copy a permission recommendation from another operating system.
- Select a restrictive preset. On macOS/Linux, choose Default for sandboxed terminal execution or Request Review for mandatory command approval. Do not use Turbo for sensitive work.
- Review the access lists. In the permissions settings, inspect Deny, Ask, and Allow entries. Remove broad allow rules that are not required, and add explicit denies for credentials, unrelated directories, and production resources.
- Constrain terminal actions. Require approval for network tools, package installation, destructive commands, privilege escalation, and commands that write outside the project. Read the complete command and its arguments before approving.
- Limit browser and URL access. Keep web access at Ask unless the task needs a specific domain. A web page can contain prompt-injection text that attempts to redirect the agent or request secrets.
- Audit MCP servers. Disable servers you do not need. For each enabled local or remote MCP server, record its tools, data sources, write capabilities, and permission rules. Treat a tool connection as an additional authority boundary.
- Separate secrets from source. Use short-lived, least-privilege credentials and environment controls. Never place private keys, tokens, or production passwords in files the agent can read simply because a build script expects them there.
- Set telemetry deliberately. Open settings, review Enable Telemetry, and apply your organization’s policy. If disabled, document that this limits the described telemetry collection but does not establish that all inference processing is local.
- Use an approved enterprise route when required. Have an administrator verify the Gemini Enterprise/Google Cloud project, region, organization policy, logging destinations, retention controls, and applicable contract before loading restricted code.
- Supervise changes. Keep version control clean, inspect diffs, run tests in an isolated environment, and review generated configuration before it reaches CI, deployment, or production. Revoke temporary credentials and remove broad rules after the task.
Threat-model choices that change the answer
Trusted repository, low-impact workstation
Default mode with workspace-only work, narrow allow rules, no secrets, and supervised diffs may be a reasonable productivity configuration. The remaining privacy question still requires checking the account’s data terms.
Untrusted repository or dependency tree
Assume files and build scripts can contain prompt-injection instructions. Favor command approval, deny network and credential paths, disable unnecessary MCP servers, and inspect every proposed tool call. Do not let a repository’s instructions redefine your permission policy.
Production credentials or regulated data
Do not rely on a consumer account or a local sandbox as the sole control. Use an organization-approved enterprise deployment, verify residency and logging, remove production credentials from the workspace, and require security or legal approval.
Highly confidential intellectual property
If your policy requires demonstrable data isolation, obtain written terms and technical evidence for the specific deployment. The consumer settings and permissions pages do not establish an on-device-only or zero-retention guarantee.
Bottom line
Antigravity is not inherently safe or unsafe for private code. Its configurable Deny, Ask, and Allow rules can limit local authority, but Turbo, broad allow rules, browser access, MCP tools, and unsandboxed commands can expand that authority quickly. Separately, local permissions do not answer whether code context is transmitted, retained, or used to improve services.
For sensitive work, choose the restrictive OS-appropriate mode, deny secrets and unrelated paths, approve commands and web/MCP actions, keep the product current, and verify the exact account and data policy. If your organization needs stronger governance, validate the Google Cloud/Gemini Enterprise deployment—and its project, region, logging, and contract—rather than assuming a consumer setup has the same protections.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
