Google expanded Gemini API Managed Agents on July 28, 2026 with Gemini 3.6 Flash as the default model, environment hooks, token budgets, scheduled triggers, an Environments API, and free-tier access. The update affects developers who want Google to host an agent loop that can reason, run code, manage files, install packages, and retrieve web information. The practical consequence is that a managed agent can now be easier to automate and constrain, but it is not a hands-off production service: Google still labels Managed Agents a public preview, gives sandboxes unrestricted outbound network access by default, and documents fail-open behavior for broken hooks. Start with a disposable, low-privilege workflow; set a token ceiling and network allowlist; then require human review before any external change.
Key takeaways
- Managed Agents remain in public preview. Google recommends reviewing agent actions and outputs before relying on them in sensitive workflows.
- The Antigravity agent now defaults to Gemini 3.6 Flash. Existing calls using
antigravity-preview-05-2026pick up that default without a code change, unless the application pins another supported model. - Budgets stop token consumption, not every form of risk.
max_total_tokenscovers input, output, and thinking tokens; network, credential, tool, and business-impact controls still need separate treatment. - Hooks can approve, deny, or audit sandbox tool calls. However, Google documents that hook crashes, timeouts, non-2xx HTTP responses, and invalid output are treated as approval.
- Outbound access is open by default. Production-oriented pilots should use an explicit network allowlist and least-privilege, short-lived credentials.
What Gemini API Managed Agents are
Managed Agents are Google’s hosted agent harness for the Gemini API. A call through the Gemini Interactions API can provision a remote Linux environment in which an agent plans, executes code, works with files, and browses the web. The general-purpose option is the Antigravity agent; Google also offers Deep Research as a specialized managed agent.
This is different from calling a Gemini model once. A managed agent may take multiple reasoning and tool-use steps to complete one interaction. Google says a single interaction typically consumes between 100,000 and 3 million tokens, although actual use depends on the task. The official Agents overview says model tokens and tool use are billed on a pay-as-you-go basis, while environment compute is not billed during the preview. Pricing, free quotas, and preview terms can change, so verify them before estimating production cost.
Google’s July 28 Managed Agents update made the following changes:
| Control | Official behavior | Practical use |
|---|---|---|
| Model selection | Gemini 3.6 Flash is the default; 3.5 Flash and 3.5 Flash-Lite can be selected | Pin a model when silent default changes would be unacceptable |
| Token budget | max_total_tokens caps input, output, and thinking tokens | Bound a run and handle incomplete status deliberately |
| Environment hooks | Scripts or HTTP handlers run before or after sandbox tool calls | Block selected actions, validate files, or export audit events |
| Scheduled triggers | A prompt, agent, environment, and cron schedule form a persistent trigger | Run recurring work without an external scheduler |
| Environments API | Environments can be listed, inspected, and deleted programmatically | Recover IDs and clean up state before the inactivity deadline |
| Free tier | Managed Agents can run in projects without active billing, within free limits | Prototype before enabling paid usage |
The table summarizes product behavior, not a recommendation to enable every feature. Scheduling a preview agent raises the need for stronger monitoring because no person initiates each run.
Decide whether a managed agent fits
Managed Agents are most relevant when a task genuinely needs a sequence of code, file, and web operations. Examples include preparing a draft analysis from public sources, checking a repository in an isolated copy, or producing files that a person reviews before use. A conventional model call or deterministic workflow is usually simpler when the application only needs classification, extraction, rewriting, or a fixed series of API calls.
Use this decision test:
- Choose a managed agent when the steps cannot be fully known in advance, sandboxed code execution is useful, and the result can be inspected before it causes an external effect.
- Choose ordinary Gemini inference when the task is one or a few bounded model calls with application-controlled tools.
- Choose conventional automation when rules can describe the workflow reliably. An agent adds cost and unpredictable paths without necessarily adding value.
- Avoid a preview dependency for a critical workflow unless the organization accepts interface, availability, and behavior changes and has a tested fallback.
Teams evaluating the underlying model separately can use the Gemini 3.6 Flash migration guide. Model quality and agent-harness suitability are two different decisions.
Configure the main control layers
Set a token budget and define incomplete handling
Google added max_total_tokens under agent_config. The limit includes input, output, and thinking tokens across the agent’s autonomous loop. When the budget is reached, the interaction pauses with status: "incomplete"; its environment state remains available, and the application can continue with previous_interaction_id and a new budget.
Treat incomplete as an expected application state, not an automatic retry signal. A blind retry can convert a ceiling into a series of larger ceilings. Record why the run stopped, inspect completed steps, and decide whether the remaining work still belongs within scope. Put a separate limit on continuations, elapsed time, tool calls, and monetary exposure because a token cap alone does not bound every resource.
Restrict outbound networking
Google’s documentation states that a managed-agent environment has unrestricted outbound network access by default. An operating-system sandbox therefore does not mean the agent is offline. Configure a network allowlist for the smallest set of domains needed by the task, and test redirects, alternate hosts, and upload paths rather than checking only that an approved homepage resolves.
Do not provide broad credentials merely because they are injected through Google’s egress proxy instead of being visible inside the sandbox. The agent can still exercise the permission those credentials grant. Google advises short-lived tokens and least-privilege service accounts or API keys. The broader AI agent evaluation security guide explains why every reachable proxy and service becomes part of the effective trust boundary.
Use pre-tool hooks for narrow enforcement
The official hooks documentation supports two lifecycle events. A pre_tool_execution hook runs before a sandbox tool and can return allow or deny. A post_tool_execution hook runs after the action and can format, validate, or log, but it cannot reverse the completed action.
Match only the documented container tool names, such as code_execution, read_file, write_file, list_files, and delete_file. Matchers use RE2 regular expressions, so test the exact rule against an inventory of allowed and denied cases. A post-tool audit hook is useful evidence, but it is not preventive control.
Most importantly, design around the documented failure semantics. If a command hook crashes, an HTTP hook returns a non-success status, a handler times out, or output is not recognized, the runtime allows the tool call to continue. This fail-open design avoids deadlocking a workflow, but it means a hook should not be the only barrier protecting a destructive action or sensitive data. Enforce critical authorization in the target system as well.
Treat persistent environments as stored state
Scheduled triggers reuse the same sandbox, so files persist between runs. Google’s overview says environments are permanently deleted after seven days of inactivity; that is a maximum lifecycle condition, not a data-retention plan. Use the Environments API to remove sessions when the workflow ends, and avoid placing secrets or unnecessary personal data in the filesystem.
Before scheduling, decide whether state should persist at all. Reusing a workspace can reduce setup work but also carries forward stale files, compromised dependencies, or outputs from an earlier run. For independent jobs, a fresh environment is easier to reason about.
A safe pilot workflow
1. Pick a reversible task
Begin with public or synthetic data and a deliverable that is reviewed rather than automatically published, merged, sent, or executed. Define success, forbidden actions, expected duration, and the files or domains the agent may use.
2. Pin important dependencies
Pin the agent model if a default change could affect quality, behavior, or compatibility. Lock package versions and start from a reviewed environment definition. If the pilot depends on Gemini 3.6 Flash behavior, maintain an application-specific evaluation set rather than relying on vendor positioning.
3. Apply independent limits
Set a conservative token budget, network allowlist, short-lived credentials, and target-system permissions. Add pre-tool hooks as another control layer. Keep external systems read-only during the first phase, and deny production data unless the use case and data policy require it.
4. Capture an audit trail
Log interaction and environment IDs, selected model, status, token usage, tool names, hook outcomes, outbound destinations, and human approval. Protect logs from sensitive prompt or output leakage. Measure task success, latency, correction effort, and cost together.
5. Test failure paths
Deliberately exhaust the token budget, deny a tool call, break a hook in a safe environment, interrupt connectivity, and resume an incomplete interaction. Confirm the application does not retry indefinitely or treat partial files as approved output.
6. Add automation only after review
Scheduled triggers should be the last step, not the first. Before enabling one, add run-count and time limits, notification and pause controls, environment cleanup, and a named owner. A recurring agent without an owner is an unattended change surface.
Teams implementing their own loop instead become responsible for state transitions, tool validation, retries, timeouts, idempotency, audit logs, credential scope, and recovery from partial external actions. That additional control is useful only when the team can operate it safely.
What this means
Google’s July update makes Managed Agents materially more controllable: token ceilings address runaway reasoning cost, hooks provide interception points, and environment management makes persistent sessions more operable. These additions fill real gaps for prototypes and supervised internal workflows.
They do not make autonomous production changes safe by default. Public-preview status, open outbound networking, persistent state, and fail-open hooks are meaningful constraints. The strongest near-term use is a bounded worker that produces an artifact for review. Moving from “draft” to “act” should require evidence from the pilot, narrow permissions at the destination, and an independent approval path.
Verification checklist
- Confirm Managed Agents availability, preview terms, pricing, quotas, and supported region for the intended project.
- Decide whether an agent is necessary instead of a model call or deterministic workflow.
- Pin the model when a default change would be operationally significant.
- Set
max_total_tokensand limits for continuations, time, tools, and total spend. - Handle
incompleteexplicitly; do not automatically grant another budget. - Replace default unrestricted outbound access with a tested network allowlist.
- Use short-lived, least-privilege credentials and enforce permissions in each target service.
- Test every hook matcher plus timeout, crash, invalid-output, and HTTP-error behavior.
- Keep a human approval step before publishing, deploying, sending, or modifying external data.
- Record interaction, environment, model, tool, budget, and approval events without leaking sensitive content.
- Delete environments and persistent files when retention is no longer required.
- Define a pause, rollback, and owner before enabling scheduled triggers.
Frequently asked questions
Are Gemini API Managed Agents generally available?
No. As of August 12, 2026, Google’s Agents overview labels Managed Agents a public preview and advises reviewing actions and outputs before sensitive use. The Interactions API may be generally available while a feature reached through it remains preview; verify each dependency separately.
Which model powers the Antigravity managed agent?
Gemini 3.6 Flash became the default on July 28, 2026. Google also documents Gemini 3.5 Flash and Gemini 3.5 Flash-Lite as selectable options through agent_config.model. Pin the model if the application must avoid automatic default changes.
What does max_total_tokens include?
Google says it includes input, output, and thinking tokens across the managed-agent interaction. Reaching it produces an incomplete interaction and preserves state for an optional continuation. It does not replace limits on time, tools, network activity, or target-system permissions.
Do environment hooks fail closed?
No. Google documents that script crashes, HTTP errors, timeouts, and unrecognized output are treated as approval, allowing the tool to continue. Use hooks as one layer and enforce critical permissions outside the agent sandbox.
Can Managed Agents run on a schedule?
Yes. Scheduled triggers bind an agent, environment, prompt, and cron schedule, and runs reuse the sandbox. Because files persist, teams should define cleanup, state-validation, monitoring, and pause procedures before enabling unattended runs.