For me the story is that Antigravity tried to prevent this with a domain whitelist and file restrictions. They forgot about a service which enables arbitrary r

For me the story is that Antigravity tried to prevent this with a domain whitelist and file restrictions. They forgot about a service which enables arbitrary redirects, so the attackers used it. And LLM itself used the system shell to pro-actively bypass the file protection.