What happened
Google says Managed Agents on the Gemini API provide a configurable agent harness. A single API call provisions a Linux sandbox in which an agent can reason, execute code, manage files and browse the web autonomously. The overview lists two managed agents: Antigravity, a general-purpose agent built with Gemini 3.8 Flash, and Deep Research, which plans and carries out multi-step research tasks such as market analysis, due diligence and literature reviews. Google also links to a visual playground for prototyping agents without code and documentation for building custom agents.
The security model described is sandbox isolation at the operating-system level. Outbound network access is unrestricted by default, but developers can restrict it or disable it through an allowlist of domains or wildcard patterns. External tools and APIs can be connected. For secrets, Google recommends managed credentials referenced by ID: an egress proxy injects them when needed, so they are not exposed inside the sandbox. The agent can use any credential it can access, however, and Google advises using least-privilege service accounts or keys, preferring short-lived tokens and rotating them regularly. The company also says developers should review outputs and actions before relying on them in sensitive workflows, particularly when data or external systems are involved.
Managed Agents are in Public Preview. Pricing is pay-as-you-go, based on Gemini model tokens and tool usage; environment compute is not billed during preview. Google says a single interaction can trigger multiple reasoning loops and typically consume 100,000 to 3 million tokens. The documentation points to separate estimated per-task costs, but the overview does not give a single fixed price. It sets a limit of 1,000 managed agents. Environments are permanently deleted after seven days of inactivity, and virtual machines shut down after a brief idle period, with a cold start when the next request restores state. The described base environment is Ubuntu-based with Python 3.12 and Node.js 22.
The overview also lists integrations with LangChain and LangGraph, LlamaIndex, CrewAI, Vercel AI SDK, Google ADK and Antigravity SDK. These are options for building Gemini-powered applications and agent workflows; the page does not say they change the managed runtime’s underlying security guarantees.
What the archive adds
New Runtime’s earlier coverage on Google’s Gemini managed-agent Files and Credentials APIs described runtime features including files, credentials, caching and context compaction. This page is related context, but the claimed self-hosting addition is not established by the documentation reviewed here; the current verified detail is the hosted sandbox’s documented operation and limits.
Trend signal
This supports the view that an agent’s runtime boundary matters: Google documents OS-level isolation, configurable network egress and credential controls, while warning that permissions still define what the agent can do. That is consistent with New Runtime’s agent security moves to runtime boundaries pattern. The documentation describes controls, not independent evidence that they prevent compromise or misuse.
Why it matters
A managed sandbox can remove the need for a team to provision an execution environment for every agent task, but it does not remove the operational decisions around access. Unrestricted outbound networking is the default, and credentials available to an agent are usable by that agent. Those settings affect exposure to data theft, unwanted external actions and unexpected API spend.
The cost model also deserves attention before adoption. Environment compute is free during preview, but a single interaction may consume 100,000 to 3 million tokens across reasoning loops, so “free sandbox” does not mean free agent work. A team evaluating this runtime should test representative tasks, measure token and tool use, set narrow network and credential scopes, and account for seven-day environment deletion and VM cold starts in workflows that depend on persistence.
What happens next
- Google will clarify whether Managed Agents support customer-hosted sandboxes. (3 months, 25%). Watch for: explicit self-hosting instructions or a customer-managed runtime in the Gemini API documentation.
Limits and uncertainty
Google’s overview documents Google-hosted sandboxes and does not establish self-hosted sandbox support, despite the claim attached to this story. It also does not quantify task success rates, security efficacy, typical cold-start duration or production availability. Public Preview status means the offering may change; no independent assessment of the isolation boundary or egress proxy is cited here. Pricing is usage-based, and the stated 100,000-to-3-million-token range is broad, so actual cost will depend on task behavior and tool use.
Skill to build now
Run one representative, non-sensitive task in a sandbox and record token consumption, tool calls, network destinations and whether the task needs persistent state. Then restrict egress to the required domains and replace broad API keys with least-privilege, preferably short-lived credentials. This makes the preview’s practical cost and permission boundary observable before the agent touches production data.
Reader takeaway
Google documents a hosted Gemini agent runtime with code execution, files and web access inside an OS-isolated Linux sandbox—not verified self-hosted sandbox support. The useful decision for builders is whether its controls, preview pricing and lifecycle limits fit a real workflow; start with narrow credentials, restricted networking and a measured task.