Summary: Google DeepMind’s July 28 update to Gemini Managed Agents makes Gemini 3.6 Flash the default model, adds environment hooks around sandbox tool calls, and introduces budget caps, scheduled triggers, environment management, and a free tier. A budget breach now produces a resumable incomplete state rather than an error. Hooks can block, lint, or audit individual tool calls.
Teams running autonomous agents on the Gemini API got a deliberately practical drop on July 28. Philipp Schmid and Mariano Cocirio of Google DeepMind used the official blog to lay out four additions to Managed Agents: an upgraded default model, environment hooks, tighter cost and scheduling controls, and a free tier. The direction continues where the previous release left off (background tasks, remote MCP integration): inside the Gemini Interactions API, one call now coordinates reasoning, code execution, package installation, file management, and web retrieval inside an isolated cloud sandbox.
Default Model: Gemini 3.6 Flash, Zero-Code Upgrade
antigravity-preview-05-2026 agents now default to Gemini 3.6 Flash — the balanced pick across reasoning, coding, and tool use — and the switch requires zero code changes; it simply takes effect on the next interaction. Teams watching their spend can pin a model explicitly through agent_config.model: Gemini 3.5 Flash for the previous-generation general agentic workflow, or Gemini 3.5 Flash-Lite for the lowest latency and cost in the 3.5 family. In effect, model selection becomes a per-agent deployment parameter instead of a platform-wide lock-in.
Environment Hooks: Block, Lint, and Audit Tool Calls Inside the Sandbox
The centerpiece of this release. Environment hooks give you a way to execute custom scripts around every tool call the agent makes inside its sandbox: place a .agents/hooks.json in the environment and the runtime will invoke your handlers on pre_tool_execution and post_tool_execution events. Regular expressions work in the matcher field — name several tools separated by |, or intercept everything with *.
A typical setup looks like this: a security-gate group executes gate.py ahead of every code_execution or write_file — whenever the script answers with {"decision": "deny", "reason": "..."}, that call is dropped and the stated reason lands in the model’s context. An auto-format group fires auto_lint.py after each tool completes, keeping style rules enforced. Handlers can also be http-typed, POSTing straight to an external endpoint — that is the bridge for piping sandbox events into your own observability or approval stack; the hooks documentation spells out the failure-handling semantics for HTTP hooks.
Google also shipped a persuasive production story: Offdeal, an AI-native investment bank. Their banker-ready decks routinely carry 30+ company logos across buyer tables, sponsor columns, and tombstone grids — each one has to be the correct company, sized right, carrying the name, transparent-backgrounded, and readable on white slides. Founder & CTO Alston Lin describes the shift bluntly: because the sandbox sits remotely, their validation code previously had nowhere to execute. Hooks changed that arithmetic — the moment the analyst agent emits its company list, a post_tool_execution hook spins up the validation pipeline inside the sandbox: candidate images are fetched, pixel-level quality checks run, every logo is checked with Gemini vision, and an approved manifest goes out as the gatekeeper for what reaches the deck. The long-standing managed-agents excuse — “custom validation can’t run in a remote sandbox” — no longer holds.
Cost Control: Budget Caps and Resumable Pauses
Multi-turn autonomous loops are the norm for managed agents, and token burn on a complex task can get away from you. agent_config now accepts max_total_tokens (input + output + thinking combined) as a hard ceiling. Hitting the cap triggers a safe pause: the interaction comes back with status: "incomplete", environment state survives intact, and resuming is a matter of passing previous_interaction_id alongside a fresh budget. A spent budget is thereby reclassified from an error into a recoverable pause — exactly what production deployments need.
The free tier opened up as well: Managed Agents run on free-tier projects with no active billing, nothing more than an API key required — enough room to experiment with agentic workflows before committing spend.
Scheduled Triggers and Environment Management
Scheduled triggers package an agent, environment, prompt, and cron schedule into one persistent resource that fires on its own, with no human in the loop; consecutive runs share the same sandbox, so files carry over between executions. Alongside it, the Environments API exposes sandbox sessions to code — list, inspect, delete. Use it to recover an environment ID after a disconnect, or to tear sandboxes down the moment a pipeline finishes rather than waiting out the 7-day TTL.
What This Means for Builders
Taken together, the updates move Managed Agents from “a service that runs your agent” toward “a governable autonomous worker”: hooks close the governance gap by finally giving validation code a place to execute, budget caps convert runaway risk into a resumable pause, and triggers plus environment management make long-lived scheduled workers realistic. Set against self-hosting your agent infrastructure, Google is offering the managed answer to the identical problem set — whether that’s worth buying depends on whether your validation pipelines and data boundaries can live inside someone else’s sandbox. The hooks mechanism genuinely narrows that objection — yet http handlers still egress to endpoints you control, so the trust question moves from “can code run there” to “who sees the events.”