Gemini API managed agents add 3.6 Flash and sandbox hooks
Google's hosted agent runtime switches its default to Gemini 3.6 Flash and adds pre/post tool-call hooks, token ceilings, cron triggers and a free tier.
Google shipped an update to Managed Agents in the Gemini API on 28 July, moving the hosted agent runtime closer to the controls operators expect from production infrastructure rather than a preview.
What changed
The antigravity-preview-05-2026 agent now defaults to Gemini 3.6 Flash, with Gemini 3.5 Flash and 3.5 Flash-Lite selectable for cheaper configurations. The headline addition is environment hooks: a .agents/hooks.json file lets developers register regex-matched handlers that fire before or after any tool call inside the sandbox, executing either a shell command or an HTTP call. Google's framing is that hooks let you block, lint or audit tool invocations — meaning policy enforcement now sits inside the managed runtime rather than being wrapped around it.
Alongside that: a max_total_tokens parameter to cap spend on a single run, state preservation so an incomplete interaction can be resumed rather than restarted, cron-syntax scheduled triggers with sandboxes that persist across executions, and an Environments API for listing, inspecting and deleting sandbox sessions. Managed agents are now reachable from free-tier projects with an API key.
Why it matters
The design pattern here is conspicuously borrowed. Pre- and post-tool-use hooks, persistent sandboxes and scheduled autonomous runs are the primitives that made local coding-agent harnesses controllable, and Google is now offering them as a hosted service with billing and a free entry tier attached. That reframes the competitive question: the differentiator for agent platforms is shifting from model quality to whether operators can constrain, observe and cost-cap what the agent does — precisely the gap that the past week's frontier-lab sandbox-escape incident made concrete.
The token ceiling and resumable state also target the specific economics that have kept agent deployments in pilot: runaway loops that burn budget with nothing to show, and long tasks that lose all progress on failure. Scheduled triggers with persistent environments push further, letting an agent hold context between unattended runs — useful, and also the configuration where hooks stop being a nicety and start being the only thing standing between a cron job and an unreviewed tool call.