Google gave its AI agent a sandbox. The broken hook gets the keys.

"Production-ready agents." 1

Google's July 28 update takes that phrase seriously. Managed Agents in the Gemini API now gives developers a remote Linux sandbox, a default Gemini 3.6 Flash model, customer-written hooks, budget limits, free-tier access, and scheduled triggers that can wake the same environment again. The useful part is real. The less flattering part is that Google's managed runtime stops at the door of policy correctness. You still have to write the rules, supply the credentials, police the network, and notice when the bouncer has stopped working. 1

Managed Agents is not just a new model endpoint. One API call provisions a Linux sandbox where the agent can reason, execute Bash, Python, or Node.js, install packages, manage files, search the web, and repeat the loop until it finishes the task. Files and installed packages can persist when later interactions reuse the same environment ID. 23

The default Antigravity agent has access to code execution, Google Search, and URL Context. Filesystem tools appear when an environment is supplied. Developers can add custom functions or remote MCP servers, or restrict the built-in tools to a smaller set. The model is therefore choosing the next action inside a runtime that can touch code, files, web pages, and whatever external APIs the developer wires in. 3

That boundary matters. The model does not automatically see a developer's laptop or private repository. You mount a Git repository, Cloud Storage object, or inline file into the environment, define tools, or inject credentials through network rules. The documentation says credentials are not exposed inside the sandbox, but it also says the agent may use any credential it can access. A secret that is technically hidden from the model is still an authorization you handed to a model-driven process. 4

The default network setting is less timid than the word "sandbox" suggests: outbound network access is unrestricted unless you configure an allowlist. The allowlist can restrict domains and transform headers, which is useful for scoped API access, but it also makes the network policy part of your application code. Forget to narrow it, and the agent starts with a broad route to the internet. 24

The new hooks feature is the sensible response to an agent that can edit files and run commands. A pre_tool_execution hook runs before a tool call and can approve or deny it. A post_tool_execution hook runs afterward and can format code, run tests, or send telemetry. Matchers use regular expressions, and HTTP hooks can send the event to an external service. 15

That is a useful control point. It is also a control point you own.

The hook runs synchronously, so the agent waits for the decision. A denial skips the tool call and returns the reason to the model, which can then try another route. But if a command hook crashes, an HTTP hook returns an error, a request times out, or the response is invalid JSON, the runtime treats the result as approval and continues. A broken guardrail is therefore not a blocked action. It is an allowed action with a missing audit trail. 5

Google's docs show the intended use: block destructive shell commands, reject reads from a private directory, or run validation after a file changes. The same docs define the failure behavior that makes this a poor substitute for a fail-closed security boundary. If the external policy service is down, the agent does not wait for certainty. It proceeds. 5

There is a second dependency hidden in the convenience. An HTTP hook needs an endpoint, an allowlisted network route, and a credential transformation if it is authenticated. The sandbox can keep the secret out of its filesystem while still sending the request through a network path you configured. The safety system now has its own uptime, deployment, monitoring, and incident-response requirements. 45

The July 28 update adds scheduled triggers that bind an agent, environment, prompt, and cron schedule into a persistent resource. Each run reuses the same sandbox, so files survive from one scheduled execution to the next. This is exactly what you want for a recurring report or maintenance task, and exactly what you should worry about when yesterday's credentials, packages, and files are still present at tomorrow's wake-up. 1

Google's environment model makes the persistence explicit. A fresh remote environment can be reused by ID, packages installed during one interaction remain available later, and environments are permanently deleted after seven days of inactivity. Virtual machines can also spin down and cold-start while the environment state remains. The runtime is not a disposable prompt box. It is a small, stateful server with an expiry timer. 24

The target audience is therefore engineering teams that want a model to operate inside a controlled workspace: inspect a repository, run tests, process documents, fetch web data, or produce a recurring artifact. It is a useful pattern for bounded work with explicit inputs and reversible outputs. It is a risky pattern for a general-purpose worker with broad credentials, unrestricted outbound access, and a schedule nobody remembers to disable. 2

The phrase "managed" can make this sound like Google owns the hard part. Google owns the sandbox, agent loop, and environment lifecycle. The customer still owns whether the mounted repository is the right one, whether the API key can mutate production, whether the hook fails open, whether the cron job is still wanted, and whether the files left behind contain something that should not be carried into the next run.

Managed Agents are available on free-tier projects, but the free tier has rate limits and a usage quota. The paid product is pay-as-you-go for Gemini model tokens and tool usage. Google says a single interaction can typically consume 100,000 to 3 million tokens, while environment compute is not billed during the preview. That is a generous trial and a very elastic definition of "one request." 12

The default model is Gemini 3.6 Flash. Its standard paid API price is $1.50 per 1 million input tokens and $7.50 per 1 million output tokens, with thinking tokens included in the output charge. Google also charges separately for some grounding tools, including Google Search after the shared monthly allowance is used. 36

The update adds max_total_tokens, which caps input, output, and thinking consumption. When the cap is reached, the interaction pauses as incomplete and preserves the environment so a later call can continue with a new budget. That is good cost control. It does not make the task's cost predictable, because the agent can still spend its allowance on several reasoning and tool turns before producing anything useful. 1

The privacy language is split across the tiers. Google's pricing page says free-tier content may be used to improve Google products, while paid-tier content is not used for that purpose. Separately, its abuse-monitoring policy says prompts, contextual information, and outputs can be retained for 55 days to detect misuse, with authorized personnel able to assess flagged content. 68

For billing-enabled projects, Google also documents API logs that are retained for up to 55 days by default and can be kept in datasets beyond that window if the developer chooses. Sharing those datasets can make them available for model improvement and training. The important distinction is that Managed Agents does not create an invisible permission to all company data. It creates a place where the permissions, mounts, network routes, logs, and credentials you configure become model-usable context. 49

Remote sandboxes, tool loops, cron triggers, and pre/post checks are all familiar engineering pieces. Google's product move is to package them as one managed API, with a model that can choose tools and carry state between runs. That removes a lot of glue code. It also moves the failure question up a level: when the model makes the wrong call, which layer was supposed to stop it, and did that layer fail closed?

The answer is not in the word "managed." It is in the configuration you wrote around the model. A narrowly scoped environment, short-lived credentials, explicit network allowlists, a monitored hook service, a token ceiling, and a human review step can make this a practical worker. A broad key, default-open network, persistent files, and a cron trigger can make it a scheduled incident with a nice API.

Managed Agents is a useful runtime for teams that want to turn a bounded script into a recurring worker without building their own sandbox, tool loop, persistence layer, and budget plumbing. The hooks, environment reuse, and token ceiling are the right features. But Google's product ends where the uncomfortable decisions begin: hook failures approve the tool call, network access starts open, credentials inherit the scope you grant, state survives across runs, and free-tier data can be used to improve Google products. This is not an autonomous employee with safety built in. It is a remote Linux worker with a model inside, a customer-owned policy layer around it, and a bouncer whose broken radio means "come on in."