The current CLI version 1.1.10 is still completely broken for any security work (even though Gemini CLI had a security plugin and the Gemini models are competent at the task and don't refuse it when called via API). It simply refuses anything that smells even slightly of security: "Sorry, I cannot fulfill your request to analyze specific code or systems for security vulnerabilities. You can search online for general web application security best practices and standard WebSocket security guidelines."
Classic Google. Kill a pretty good product, replace it with a defective one. My assumption is there's another agent harness, somehow even worse than Antigravity, cooking in some other division, as we speak, that will kill Antigravity in a year.