Gemini managed agents: a sandboxed Antigravity agent in one Interactions API call, with reusable environments and credentials that never enter the sandbox

What the talk shows

• The idea. Instead of running a coding agent on your laptop, call an agent in the cloud. The sandbox, the harness and the scaling are handled for you, so adding capacity means making more API calls.
• Building blocks. The harness (the same one that runs in Google's Antigravity products), the environment (the sandbox file system), skills, credentials and triggers.
• Two kinds of state. Interactions hold the conversation, and an interaction's ID is passed to the next turn. Environments hold the files. Because they are separate, a second agent can reuse the first agent's environment with a fresh context window.
• The demo. An SEC-filing researcher agent writes metrics for a company to a file, a "quant" agent reuses the same environment to read that file and run Python for a valuation, and a third agent turns the output into a report. He says connecting MCP servers would let the last step write to Google Docs or Slack.
• Secrets. A proxy sits between the sandbox and the API. The sandbox holds only a placeholder token; the proxy injects the real one when the agent calls the matching API, so the agent never sees your GitHub token.
• Models. He says the model is a one-line setting in the agent config and recommends Gemini 4 Argon for deep reasoning, with Flash for speed, and describes a "long decode" mode in which the 1M-token window is shared between input, thinking and output.

Checked against Google's documentation

From the Gemini API docs (managed agents quickstart, building managed agents, credentials and the antigravity-preview-09-2026 model page), read 2026-10-26.

from google import genai

client = genai.Client()
interaction = client.interactions.create(
    agent="antigravity-preview-09-2026",
    input="...",
    environment="remote",      # a new sandbox
)
print(interaction.id, interaction.environment_id, interaction.output_text)

# continue the conversation in the same sandbox
interaction_2 = client.interactions.create(
    agent="antigravity-preview-09-2026",
    previous_interaction_id=interaction.id,
    environment=interaction.environment_id,
    input="...",
)

• State rules. Omitting previous_interaction_id keeps the files but starts a fresh conversation. Using environment="remote" with a previous_interaction_id keeps the conversation in a new sandbox. Files can be downloaded from https://generativelanguage.googleapis.com/v1beta/files/environment-{env_id}:download?alt=media.
• Saving an agent. client.agents.create(...) takes id (must not start with gemini-, google- or antigravity-), base_agent (currently only antigravity-preview-09-2026), agent_config, system_instruction, tools (default code_execution, google_search, url_context; mcp_server and function are also supported) and base_environment. Invoke it with agent="<id>" and environment="remote"; each invocation forks the base environment.
• Mounts. In base_environment.sources, an inline source targeting .agents/AGENTS.md is loaded as system instructions at startup, skills go under .agents/skills/<skill-name>/SKILL.md and are auto-discovered, and a repository source mounts a Git repository.
• Credentials. Created with client.credentials.create and referenced by ID. Types are bearer_token, oauth2 and environment_variable; secret values are write-only. An environment-variable credential appears in the container as a placeholder named __GEMINI_CRED_<credential-id>__, and the proxy swaps in the real value only for requests to the credential's trusted_domains. Plain env values are readable in the sandbox, so never put secrets there.
• Limits. Preview ("features and schemas may change"), up to 1,000 managed agents, no versioning or rollback and no subagent nesting yet. The model page lists a 1,048,576-token input window with compaction at about 135K and a 65,536-token output limit. The docs state no price on these pages.

Where the talk and the docs differ

• Models. The docs list gemini-3.8-flash (the default), gemini-3.6-flash and gemini-3.5-flash-lite as agent_config models, and say the model cannot change at invocation time for a named agent. Gemini 4 Argon is not on that list as of 2026-10-26, although the talk recommends it.
• Long output. The shared-window "long decode" mode is not mentioned on the pages we read, and the model page gives a 65,536-token output limit.
• Triggers. The talk describes scheduling an agent (for example every morning before the market opens). The page on building managed agents says it does not cover triggers, so we could not confirm how they are set up.

Gotchas & Caveats

• The speaker works at Google DeepMind, so the talk is a product pitch. The financial examples are demos, not investment advice.
• Everything here is preview. The agent ID changed between versions in the docs (05-2026 then 09-2026), so pin the ID you tested.

Key Takeaways

• One call with environment="remote" gives you a sandboxed agent; carry environment_id forward to share files and previous_interaction_id to share the conversation.
• Mount instructions at .agents/AGENTS.md and skills at .agents/skills/ so a saved agent behaves the same on every run.
• Store tokens as credentials, not in env, so the proxy injects them and the sandbox never holds the secret.