Gemini API Managed Agents Update: 3.6 Flash, Hooks, Budgets, and Cron (2026)

Google announced a July 28, 2026 operations update for Gemini API Managed Agents.

📑Table of Contents

1. What changed on 2026-07-28 — and what to decide first
2. Default Gemini 3.6 Flash and choosing agent_config.model
3. Environment hooks — deny and verify sandbox tools
4. Budgets, free tier, cron, and Environments API
5. Adoption checklist and how this differs from local CLI hooks
6. FAQ
7. Summary — operational actions for today

---

What changed on 2026-07-28 — and what to decide first

Control package, not “agents exist”

The core story is control, not “agents exist.”

The default model for agent antigravity-preview-05-2026 is now Gemini 3.6 Flash, applied on the next interaction with no code changes.

What landed in the package

The same package adds:

• Environment hooks (.agents/hooks.json)
• max_total_tokens budgets
• cron triggers
• free-tier access
• Environments API

That moves teams from “run a sandbox in one call” toward stop, measure, and schedule controls.

Official framing

The Google Keyword post (Philipp Schmid / Mariano Cocirio) pairs the default-model change with hooks, budgets, schedules, Environments API, and free-tier access.

Decide early whether you will try free tier, pin the model, put pre-deny on destructive tools, and how you will schedule work and clean up environments.

Reader branches

1. Try — free tier works even without project billing (per Google)
2. Pin the model — avoid silent default drift with agent_config.model
3. Guard tools — pre_tool_execution deny on destructive matchers; optional post verification
4. Schedule and reclaim — Triggers (cron) reuse one sandbox; Environments API for cleanup

Axis vs earlier expansions

Earlier expansions (background tasks / remote MCP) sit on a different axis.

• The single Interactions API call that runs reasoning, code execution, package install, files, and web retrieval in a remote sandbox remains the base path
• SDK examples use @google/genai
• For the GA foundation, see our Managed Agents API GA brief

Source:

• Google Keyword blog (2026-07-28)

---

Default Gemini 3.6 Flash and choosing agent_config.model

Default switch without code changes

For antigravity-preview-05-2026, the next interaction picks up Gemini 3.6 Flash without code changes. Pin only when you need stability.

Model setting table

Model setting	Role	When to use
(unset / default)	Gemini 3.6 Flash	Follow the latest default in trials and greenfield work
gemini-3.6-flash	Explicit 3.6 Flash	Keep the choice visible in config even if it matches default
gemini-3.5-flash	Prior Flash	Hold prior behavior; A/B or regression
gemini-3.5-flash-lite	Lighter Flash	Cost/latency-first simple tasks

Pin and pricing notes

Practical notes:

• Follow default when you want improvements automatically; accept preview-era behavior drift
• Pin when production-like reproducibility matters and model upgrades need change control
• Pricing: independent write-ups (for example AI Pricing Guru) discuss rate tables and preview-era unbilled sandbox compute, but always re-check Gemini API pricing for agents and your project billing

Docs and preview limits

Antigravity agent docs describe agent_config.model for Gemini 3.x Flash families.

Preview limits still apply: generation config (temperature and similar) and structured output are not fully available, so “change the model” does not mean full schema control.

Sources for this section

• Google Keyword blog
• Antigravity agent docs
• AI Pricing Guru (July 2026)

---

Environment hooks — deny and verify sandbox tools

Environment hooks are the main operational lever. Immediately before or after sandbox code execution and filesystem tools, you can run a custom command or HTTP handler.

Configuration basics

• Location: .agents/hooks.json (or inline via environment sources)
• Events: pre_tool_execution / post_tool_execution
• Matcher: regular expressions (including | and *)
• Handlers: command (in-sandbox) or http (external POST)

On pre-hooks, returning {"decision":"deny","reason":"..."} skips the tool and feeds the reason back into model context—useful for destructive command gates or blocking writes outside an allowlist.

Constraints you must design around

1. Sandbox built-in tools only — e.g. code_execution, read_file, write_file, list_files, delete_file. Custom function calling and remote MCP are out of scope
2. Fail-open — non-zero exit, timeout, or hook failure is logged and the tool still runs. Broken linters will not deadlock the agent; do not treat hooks as the only hard mandatory gate
3. HTTP hooks — container network only; target URLs need network.allowlist; loopback is blocked
4. Tamper surface — a writable workspace can let the agent rewrite hooks.json/scripts; use read-only mounts when integrity matters

Example: OffDeal post-tool checks

Google’s post cites OffDeal running pixel-level logo verification on decks via post_tool_execution. Independent outlets such as Unite.AI and AIToolly describe the same control-layer addition.

Source

Boundary vs local CLI hooks

Unlike local CLI hooks (for example Claude Code), Managed Agents hooks sit around cloud sandbox tools.

• Different boundary means “hooks exist” is not “every tool can be blocked”
• For local hook thinking, see Steering Claude Code: skills and hooks

Sources for this section

• Agent hooks docs
• Google Keyword blog
• Unite.AI
• AIToolly (July 2026)

---

Budgets, free tier, cron, and Environments API

Free tier

Google states Managed Agents can be tried without project billing. Treat that as evaluation access; production still needs live pricing, quota, and preview-limit checks.

max_total_tokens

agent_config.max_total_tokens caps input + output + thinking.

• On hit, status becomes "incomplete"
• Environment state is kept
• You can resume with previous_interaction_id
• Design for pause-and-resume after adjusting budget—not for discarding state on every cap

Cron triggers

Persist agent / environment / prompt / cron as resources and reuse one sandbox so files survive between runs.

Docs cover create, list, get, pause, resume, delete, run-now, and listing executions.

Environments API

List, inspect, and delete environments to recover IDs after disconnect and clean up before the 7-day TTL.

More schedules mean more abandoned environments unless reclaim policy is explicit.

Control map

Control	Purpose	Primary knob	Watch-outs
Model pin	Follow default or freeze	agent_config.model	Put default drift under change control
Hooks	Deny / lint / audit around tools	.agents/hooks.json	Fail-open; MCP/custom functions excluded
Budget	Cap runaway tokens	max_total_tokens	Design incomplete resume early
Cron	Scheduled runs	Triggers API	Shared sandbox and leftover files
Env lifecycle	Recover / delete	Environments API	Do not wait on TTL alone

Sources for this section

• Google Keyword blog
• Antigravity agent docs
• HyperAI (July 2026)

---

Adoption checklist and how this differs from local CLI hooks

Cloud runtime guards vs local CLI hooks

Dimension	Gemini Managed Agents hooks	Typical local CLI hooks (e.g. Claude Code)
Where they run	Inside remote sandbox	Developer machine / local agent runtime
Primary targets	Built-in code/filesystem tools	Tools/shell mediated by the CLI
MCP & custom functions	Out of hook scope (official)	Product-dependent
On hook failure	Fail-open (tool continues)	Product-dependent
Best fit	Long autonomous loops + in-sandbox checks + budgets	Interactive coding gates

Related tracks

CLI packaging of agents is a separate track—see agents-cli v1.0.0. For IDE-oriented Antigravity product context, see Antigravity pricing and feature comparison.

Checklist for today

• ✓ Run one antigravity-preview-05-2026 job on free tier and confirm the 3.6 Flash-family default
• ✓ Decide whether production-like work pins agent_config.model or follows default
• ✓ Add one pre_tool_execution deny for destructive command matchers
• ✓ Optionally add post_tool_execution lint/artifact checks (OffDeal-style)
• ✓ Set max_total_tokens and a previous_interaction_id resume path
• ✓ Choose Trigger + shared environment vs fresh remote per run for recurring jobs
• ✓ Make hook sources read-only if tamper resistance matters
• ✓ Re-read preview limits (generation config, structured output, etc.) in the docs

Fit / no-fit

• Fit: long sandbox loops that need deny/verify mid-run, token caps with resume, cron on a sticky environment
• No-fit: control plane is almost only remote MCP or client custom functions; you require hard-stop on any hook failure (conflicts with fail-open)

---

FAQ

Do I need to rewrite existing code?

Q: Do I need to rewrite existing Managed Agents code?

Not for the default 3.6 Flash switch. Add agent_config and environment settings only when you pin models or enable hooks/budgets.

Can hooks block MCP or custom functions?

Q: Can hooks block remote MCP or custom functions?

Official docs limit hooks to built-in sandbox code execution and filesystem tools. Custom functions and remote MCP are excluded.

What if a hook fails?

Q: If a hook fails, does the tool still run?

Yes. Fail-open continues the tool after non-zero exit, timeout, or failure. Do not rely on hooks as the sole mandatory gate.

Does max_total_tokens wipe state?

Q: Does hitting max_total_tokens wipe the environment?

Google describes incomplete pause with state retained and resume via previous_interaction_id.

Is free tier enough for production?

Q: Is free tier enough for production?

No—use it for evaluation. Re-check pricing, quotas, and preview limits, and lock budget plus hook policy before production.

---

Summary — operational actions for today

Actions for today

1. Verify facts on the official blog plus agent-hooks and antigravity-agent docs
2. Pick one first lever: model pin, hooks, budget, or cron
3. Next steps: one free-tier run → one pre-deny → set max_total_tokens → add a Trigger if needed
4. Residual risks: fail-open, MCP out of scope, preview schema change, hook tampering

Closing note

Managed Agents now look less like a demo sandbox and more like an agent runtime with stop and measure controls. Start with one free-tier run and one pre-deny, and confirm pause-and-resume behavior before scaling schedules.