Using Antigravity to Translate a Threat Report: Reflections on Agent Information Security

A PDF translation workflow made me rethink the data boundaries of cloud-based agents.

Translation note: This English version was translated by Codex (GPT-5) on 2026-09-19. The source text is the corresponding Chinese post in this repository.

Using Antigravity to Translate a PDF

In mid-September, I saw news coverage of an Anthropic threat report that contained a large number of disturbing cases (Anthropic, 2026b). I wanted to read the original report. When possible, I would rather consult a primary source than rely only on someone else’s summary.

I found the PDF on Anthropic’s website and downloaded it locally:

Detecting and countering misuse of AI: September 2026

I then asked Antigravity to process the PDF and translate it.

Splitting and translating Anthropic’s threat report in Antigravity — In Antigravity, the Agent splits the PDF and runs text recognition and translation tasks in parallel.

I used concurrent subtasks to improve speed. However, if the model is capable enough, these prompts may be unnecessary: the model may be able to decide which approach is most efficient by itself.

I also asked the Agent to make a simple count of the report’s different case categories:

Page distribution across threat categories in Anthropic’s report — Page distribution across different threat categories in Anthropic’s report.

About a year ago, I would not have expected an Agent itself to complete this kind of work. Now, many of the functional boundaries of specialized translation tools are being compressed by general-purpose Agents.

I had previously tried PDFMathTranslate. Its advantage is that it lets users choose different translation engines, but deployment and debugging are relatively cumbersome. These smaller capabilities can now also be implemented through a general-purpose Agent or a Codex sub-agent (PDFMathTranslate, n.d.).

Agents are flattening the “feature moats” of many specialized software products. In the future, the remaining moats may shift toward workflows, reliability, specialized data, compliance, user interfaces, and integrations.

After the Threat Report

The report quickly led to discussions about cybersecurity. It also described how intermediaries, proxies, and other infrastructure can expand the reach of model use (Anthropic, 2026b).

This reminded me that information security is not only a question of cryptography or server configuration.

A still from the film Initial D — A still from *Initial D* (2005). History contains many examples of private digital information leaks causing serious real-world consequences.

The difference with an AI Agent is that its potential data access can be much broader than that of a traditional application. It does not merely wait for text input; it may also read files, call tools, execute commands, and send the results to a remote model for further processing.

How an Agent Works

In the cloud-based workflow I used, the model’s inference mainly happens in the cloud. For an Agent to process a local PDF, it must receive at least the relevant files or text. Exactly what gets uploaded depends on the client implementation, the Agent’s permissions, and the workflow.

Data moving between a local computer and a cloud model during Agent work — During Agent work, local files, source data, and model results may move between the local computer and the cloud.

When permissions, data boundaries, or the supply chain are poorly controlled, an Agent can shift from an “assistant” into a “thief”: it may read and upload data, and hand information that originally existed only on the local device to a third party.

An Agent risk diagram showing data uploaded to the cloud and stored for a long time — When upload scope and retention time are opaque, an Agent’s convenience becomes a new data exposure surface.

On September 18, developer Ferstar reported through reverse engineering that a closed-source Agent from a Chinese foundation-model provider uploaded workspace snapshots. The provider later apologized and explained that the issue came from its repository indexing feature (Ferstar, 2026; IT之家, 2026).

A news report screenshot about a Chinese model provider's repository upload controversy — A report about a Chinese model provider's repository indexing and workspace data upload controversy.

The incident made me think that security boundaries cannot be evaluated only by asking whether a model trains on user data. We also need to ask: What did the client read? What did it upload? Who can decrypt it? How long is it stored? Can users actually disable the feature?

Possible Solutions

In June, Anthropic changed the data policy for Claude Fable. Fable now requires 30-day data retention by default for safety monitoring (Anthropic, 2026a). This change prompted some enterprise customers to question zero data retention (ZDR), intellectual property, and the scope of log retention.

Within days of the threat report’s publication on September 10, concerns from enterprise customers about AI data boundaries also became public. On September 14, Reuters, citing The Information, reported that NVIDIA, Palantir, Booz Allen, and other companies had begun restricting Anthropic models in sensitive workflows (Reuters, 2026).

Different solutions can be selected according to data sensitivity:

Choosing SaaS, zero-data-retention, private-cloud, or isolated local environments according to data sensitivity — Choosing an AI deployment model according to data sensitivity: from ordinary SaaS to zero data retention, private cloud, and isolated local environments.

Ideally, all data could be processed locally and never leave the device. Even when a cloud provider offers compliance reviews and zero-data-retention guarantees, data that leaves the local device has entered a new trust boundary and cannot be treated as having the same security level as local processing.

The future will therefore likely focus on both safer, more efficient cloud computing and local models that are capable enough for demanding work.

One illustrative local AI setup for an individual or small team could be:

Use Google Gemma 4 as the base model;
Use NVIDIA DGX Spark as a small AI workstation.

This is only an illustrative combination. A real enterprise deployment would also need IAM, network isolation, auditing, key management, backups, and endpoint security.

Conclusion

What I really observed was not that Agents will necessarily “steal” data. It was that using a cloud-based Agent moves the security boundary beyond the local device and into the model provider, client, proxy service, plugins, and toolchain.

The more capable an Agent becomes, the more it can read and operate on. Least privilege, data classification, and verifiable supply-chain transparency will therefore become increasingly important.

References

Anthropic. (2026a, June 9). Claude Fable 5. https://www.anthropic.com/claude/fable

Anthropic. (2026b, September 10). Detecting and countering misuse of AI: September 2026. https://www.anthropic.com/threat-intelligence-report-september-2026

Ferstar. (2026, September 18). Investigating a Chinese model provider’s silent upload of the full Git history. Code is cheap, let’s talk. Original report

IT之家. (2026, September 18). Chinese model provider accused of “stealing code”: Official response says the issue has been fixed and the codebase will be open-sourced. IT之家. https://www.ithome.com/1/004/310.htm

PDFMathTranslate. (n.d.). PDFMathTranslate [Computer software]. GitHub. https://github.com/PDFMathTranslate/PDFMathTranslate

Reuters. (2026, September 14). Palantir, Nvidia curb AI model use over data fears, The Information reports. Yahoo Finance. https://finance.yahoo.com/technology/ai/articles/palantir-nvidia-curb-ai-model-151108619.html