Google Just Changed How Its Managed Agents Work

Google has officially updated its Gemini managed agents framework, deploying an upgraded execution harness under the release tag antigravity-preview-09-2026. The update ports the execution loops, context management strategies, and containerized tool configurations originally developed for Google’s Antigravity developer environment directly into Google AI Studio and the Gemini Interactions API.

Instead of requiring engineering teams to orchestrate fragile local Docker containers, configure ad-hoc file synchronizers, or expose plaintext API secrets in runtime shell environments, Google’s updated architecture packages an isolated, remote Linux sandbox directly behind a unified API endpoint. For teams building autonomous enterprise software workflows, these updated Gemini managed agents drastically cut execution overhead while eliminating runtime environment drift.

According to Google’s official release announcement on X, the Antigravity harness directly resolves community friction points around multi-turn token bloat and exfiltration attack vectors. Here is a comprehensive systems teardown of how the update operates, the mechanics of the two new system APIs, the five supported model sub-variants, and the real-world economics governing multi-turn runs.

The Antigravity Harness for Gemini Managed Agents

The primary engineering objective behind antigravity-preview-09-2026 is stabilizing the multi-turn agent execution loop. Under the prior managed agent preview, developers frequently encountered state fragmentation across tool invocations, non-deterministic planning drift, and rapid context window exhaustion—issues reminiscent of the runaway token expenses analyzed in our study on coding agent token limits and usage billing.

The updated Antigravity harness standardizes execution across four functional runtime layers:

• Remote Linux Sandbox Runtime: Each session can instantiate a fresh container or reattach to an existing persistent environment (env_id). The sandbox provides an isolated Linux filesystem supporting Bash, Python 3.12, and Node.js. The agent runs terminal commands, installs package dependencies, compiles binaries, and iterates on syntax or test failures autonomously.
• Automated Context Compaction at ~135k Tokens: Complex multi-turn software development tasks generate massive execution logs. To prevent attention degradation and out-of-memory errors, the harness automatically invokes context compaction when total prompt volume reaches approximately 135k tokens, synthesizing historical actions and terminal traces into structured checkpoints while strictly preserving active variables, modified file paths, and objective parameters.
• Native Tool Integration Array: Out of the box, the harness couples code_execution, filesystem tools, google_search, and url_context. It also provides zero-overhead bindings for custom client-side function calling and remote Model Context Protocol (MCP) servers.
• Background & Scheduled Cron Execution: Interactions can execute asynchronously (background=True) with real-time SSE event streaming, or bind to scheduled cron triggers (e.g., 0 9 * * 1-5) for autonomous morning repository audits and security scanning.

Model Sub-Variants & Version Pinning

While the harness defaults to Gemini 3.8 Flash, developers utilizing Gemini managed agents are not confined to a single model checkpoint. (For comparative latency and token economics against competing lightweight models, see our benchmark teardown of Qwen 3.8 Omni Flash vs Gemini 3.8 Flash, as well as the forensic audit of the Gemini 4 Pro Arena leak). Google has exposed five distinct Flash sub-variants within agent_config.model, allowing engineering teams to balance reasoning depth, inference latency, and API spend:

A key operational distinction exists between ad-hoc sessions and production deployments. In ad-hoc sessions launched via client.interactions.create(), developers can dynamically vary the model per interaction turn. However, when provisioning Gemini managed agents via client.agents.create(), the underlying model is strictly locked at creation time. The Interactions API explicitly prohibits overriding the model at runtime, ensuring regression protection, deterministic tool performance, and reproducible evaluation boundaries across CI/CD pipelines.

The Credentials API: Zero-Trust Token Proxying

The primary security vulnerability in autonomous software agents has always been secret exfiltration. Passing personal access tokens (PATs), AWS secret keys, or enterprise webhook secrets into raw prompt instructions or container .env files creates catastrophic risk: prompt injection attacks can extract secrets, while model hallucinations can inadvertently commit credentials to source control—a danger closely tied to the reinforcement learning failure modes examined in our analysis of RLVR specification gaming and model unfaithful reasoning.

The Credentials API (/v1beta/agent-credentials) enforces complete zero-trust secret isolation for Gemini managed agents:

The Credentials API supports three production operational modes:

• bearer_token: Injects static tokens or API keys into request headers for specific domains (e.g., api.github.com).
• oauth2: Manages user-delegated authorization flows. Google’s egress proxy handles token refreshes automatically in the background, preventing session breaks when tokens expire.
• environment_variable: Injects a sanitized placeholder into the agent’s Linux shell. When client libraries execute an outbound call, the egress gateway transparently substitutes the real secret.

The Files API: Bidirectional Data Exchange

Moving enterprise codebases and assets into remote sandboxes has historically required awkward base64 strings or complicated cloud storage mounting scripts. The new Files API (/v1beta/environments/{env_id}/files) establishes a high-performance data plane directly into the remote environment for Gemini managed agents.

• Direct Data Ingestion: Upload CSV/XLSX spreadsheets, PDF specifications, or complete Git repositories into the /workspace mount via a single API call.
• Finished Artifact Extraction: When an agent finishes building a dashboard, compiling a Python wheel, or generating analytical charts, developers can download individual files or fetch entire project trees as compressed tar archives.
• Decoupled Storage Persistence: Sandbox storage persists independently of the interaction context. A developer can pause an agent session, inspect files, and resume execution later in the same workspace environment without re-uploading dependencies.

Systems Telemetry & Cost Economics

Google shared empirical telemetry comparing the antigravity-preview-09-2026 harness against previous managed agent implementations across real-world enterprise engineering workloads:

Estimated Production Cost per Task Category

These economics reveal why Google standardized on Gemini 3.8 Flash for Gemini managed agents. At $0.25 to $3.25 per multi-turn job, autonomous agent execution enters viable enterprise territory compared to running equivalent agentic loops on frontier flagship models, where intermediate reasoning tokens routinely exceed $15 to $40 per session as documented in our datacenter inference TCO breakdown.

Implementation Blueprint: Python SDK

The following production blueprint demonstrates initializing an agent interaction with a specific sub-variant (gemini-3.8-flash), mounting a GitHub repository, and binding it to authenticated egress via the Credentials API:

from google import genai

client = genai.Client()

# Launch an autonomous agent session using the Antigravity harness
interaction = client.interactions.create(
    agent="antigravity-preview-09-2026",
    input="Review open pull requests, execute the test suite, and compile a defect report.",
    environment={
        "type": "remote",
        "sources": [
            {
                "type": "repository",
                "source": "https://github.com/my-org/core-service",
                "target": "/workspace/app"
            }
        ],
        "network": {
            "allowlist": [
                { "domain": "api.github.com", "credential": "github-production" },
                { "domain": "pypi.org" },
                { "domain": "files.pythonhosted.org" }
            ]
        }
    },
    agent_config={
        "type": "antigravity",
        "model": "gemini-3.8-flash"  # Sub-variants: 3.8, 3.7, 3.6, 3.5, 3.5-lite
    }
)

print(interaction.output_text)

The entire workflow executes safely inside Google’s managed remote environment. The agent clones the private repository using the credentials proxy, runs the test runner inside the sandbox, resolves dependency anomalies, and returns the verified report without credentials ever touching model memory.

Strategic Takeaways for Technical Teams

Google’s update underscores an undeniable reality across the frontier AI landscape: raw parameter scale is no longer the bottleneck for agentic utility. Long-term production viability hinges on the harness architecture—environment isolation, out-of-band secret management, context compaction, and token efficiency surrounding the model.

• Eliminating Infrastructure Drag: By managing container provisioning, egress routing, and context compaction internally, Gemini managed agents eliminate the operational burden of building and securing custom agent execution clusters.
• Predictable Inference Budgets: The combination of 40% fewer output tokens on file operations and a 16% boost in prompt cache hits directly counters runaway compute bills across automated continuous integration pipelines.
• Enterprise Security Baseline: The Credentials API establishes a production-grade blueprint for connecting autonomous models to mission-critical infrastructure without creating prompt injection vulnerabilities.

The antigravity-preview-09-2026 harness is live today in Google AI Studio and across the Gemini Interactions API SDKs.

Frequently Asked Questions