How to Use Google AI Studio Managed Agents in 2026: Hooks, Triggers, and Free-Tier Setup Guide

Google AI Studio's managed agents got their biggest upgrade yet on July 28, 2026: the Antigravity agent now defaults to Gemini 3.6 Flash, runs on the free tier, and ships with environment hooks that let you block, audit, or lint every tool call inside the sandbox — plus token budget caps, cron-scheduled triggers, and a programmatic Environments API. For developers and small teams who have been watching agent frameworks from the sidelines, this is the first time you can build and test a production-grade autonomous agent with zero infrastructure and zero cost.

Verdict: If you're building AI agents in 2026, Google AI Studio's managed agents are now the fastest zero-cost path from idea to working autonomous workflow. The hooks system alone — which lets your custom script approve or deny every tool call the agent makes — solves the biggest real-world problem with autonomous agents: preventing them from running commands you didn't authorize. The free tier makes it accessible to anyone with a Google account, and the token caps + scheduled triggers make it production-ready rather than just a demo toy.

Last verified: 2026-08-02

• Default model: Gemini 3.6 Flash (gemini-3.6-flash) — upgraded automatically, no code changes
• Free tier: Available on projects without billing enabled (standard Flash rate limits apply: ~15 RPM, ~1,500 RPD)
• Biggest feature: Environment hooks (pre_tool_execution and post_tool_execution) — your scripts run before/after every tool call
• Cost control: max_total_tokens caps total consumption; pauses safely at the limit
• Automation: Scheduled triggers bind agent + environment + prompt + cron into a persistent recurring resource
• Environment TTL is 7 days; delete environments programmatically via the Environments API
• Pricing if you go paid: $1.50 per 1M input tokens, $7.50 per 1M output tokens for Gemini 3.6 Flash

---

What Are Managed Agents in Google AI Studio?

Managed agents are Google-hosted AI agents that run autonomously inside an isolated Linux sandbox. A single API call to the Gemini API provisions the sandbox, and the agent reasons, writes and executes code, installs packages, reads and writes files, and browses the web — all without you managing any infrastructure. The default managed agent is called the Antigravity agent (antigravity-preview-05-2026), and it's the same agent harness that powers Google's own agent products.

Unlike a standard chat call where you ask one question and get one answer, a managed agent takes a single instruction and runs a multi-step loop: it plans, calls tools, observes results, and iterates until the task is done or it hits a budget cap. Google describes it as a "configurable agent harness" — you provide the instructions, tools, and environment configuration, and Google runs the whole execution loop in a secure cloud sandbox.

The key building blocks are:

• Agent: The reasoning loop (powered by a Gemini model) that plans and calls tools
• Environment: An ephemeral Linux sandbox where the agent runs code and manages files
• Interaction: A single task execution — one prompt in, one completed workflow out
• Hooks: Your custom scripts that intercept tool calls before or after they run (new in this update)
• Triggers: Scheduled, recurring agent runs bound to a cron expression (new in this update)

For a deeper comparison of how managed agents fit into the broader landscape of agent operating systems and frameworks, see our guide to setting up an AI agent operating system.

---

What Changed on July 28, 2026?

Google's second major update to managed agents (the first was the initial launch on May 19, 2026, followed by a July 7 update adding background execution and remote MCP) shipped five features that move managed agents from "interesting preview" to "worth building on." The official announcement on Google's blog covers the full breakdown.

1. Gemini 3.6 Flash is now the default model

The Antigravity agent now runs Gemini 3.6 Flash by default — no code changes required. Your next interaction picks it up automatically. Gemini 3.6 Flash was released on July 21, 2026 and is described by Google as the balanced model for reasoning, coding, and tool use, which is exactly what an agent does all day. It consumes 17% fewer output tokens than Gemini 3.5 Flash while taking fewer reasoning steps for multi-step workflows.

You can also explicitly select a model by passing agent_config.model:

Model	Model ID	Best For
Gemini 3.6 Flash	gemini-3.6-flash	Default; balanced reasoning, coding, and tool use
Gemini 3.5 Flash	gemini-3.5-flash	Previous generation; general agentic workflows
Gemini 3.5 Flash-Lite	gemini-3.5-flash-lite	Lowest latency and cost in the 3.5 family

import { GoogleGenAI } from "@google/genai";

const client = new GoogleGenAI({});

const interaction = await client.interactions.create({
  agent: "antigravity-preview-05-2026",
  input: "Audit all dependencies in package.json, upgrade outdated packages, and verify the build by running npm test.",
  environment: "remote",
  agent_config: {
    type: "antigravity",
    model: "gemini-3.5-flash-lite", // explicit model selection
  },
});

console.log(interaction.output_text);

2. Free tier access

Managed agents are now available on free tier projects. You can experiment with agentic workflows using an API key from a project that has no billing enabled. Standard Flash free-tier rate limits apply — approximately 15 requests per minute and 1,500 requests per day, per the Gemini API rate limits documentation. Environment compute is not billed during the preview period.

One important catch: if you enable billing on a project, the free tier disappears on that project entirely. Keep your prototyping on a separate API key project if you want to stay on free tier.

3. Environment hooks (the biggest feature)

This is the part that solves the real-world problem. Agents are autonomous — that's the point — but it also means you're not watching every step. Environment hooks let you run your custom scripts before or after every single tool call the agent makes inside its sandbox. You add a .agents/hooks.json file to your environment, and the runtime executes your handlers on two events.

Per Google's hooks documentation, the five built-in tools you can intercept are: code_execution, read_file, write_file, list_files, and delete_file. The matcher field uses RE2 regular expressions, so you can target multiple tools with | or catch everything with *.

4. Token budget controls

Agents run multi-turn loops, so a complex task can consume a lot of tokens. You pass max_total_tokens inside agent_config to cap total consumption — input, output, and thinking all counted together. When the agent hits the cap, execution pauses safely and the interaction returns status: "incomplete". The environment state is preserved, so you pass previous_interaction_id with a fresh cap and the agent continues from where it stopped.

5. Scheduled triggers

A trigger binds an agent, an environment, a prompt, and a cron schedule into one persistent resource that fires without you touching it. Each run reuses the same sandbox, so files persist across runs — the agent builds on its own previous work instead of starting over. Per Google's agents overview, triggers pause automatically after five consecutive failures, which is the kind of production-safety detail that matters at 3 AM. A separate Environments API lets you list, inspect, and delete sandbox sessions from code, so you can clean up when your pipeline finishes instead of waiting for the 7-day TTL.

---

How to Set Up Environment Hooks (Step by Step)

Environment hooks are the most practically useful feature in this update. Here's how to set them up from scratch.

Step 1: Create a free-tier API key

1. Go to Google AI Studio and sign in with a Google account.
2. Navigate to the API keys page and create a new API key.
3. Associate it with a new project (do NOT enable billing on this project if you want to stay on free tier).

Step 2: Set up your environment files

Create a project directory with the following structure:

my-agent-project/
  .agents/
    AGENTS.md          # System instructions and persona
    hooks.json         # Hook definitions
    hooks-scripts/
      gate.py          # Your pre-tool guardrail script
      auto_lint.py     # Your post-tool cleanup script
  app.py               # Your main application code

Step 3: Write your hooks.json

The hooks file groups event definitions under custom names. Each group can be enabled or disabled independently. Here's a working example that blocks destructive shell commands before they run and auto-formats Python files after they're written:

{
  "security-gate": {
    "enabled": true,
    "pre_tool_execution": [
      {
        "matcher": "code_execution",
        "hooks": [
          {
            "type": "command",
            "command": "python3 /.agents/hooks-scripts/gate.py",
            "timeout": 10
          }
        ]
      }
    ]
  },
  "auto-format": {
    "post_tool_execution": [
      {
        "matcher": "write_file",
        "hooks": [
          {
            "type": "command",
            "command": "python3 /.agents/hooks-scripts/auto_lint.py",
            "timeout": 15
          }
        ]
      }
    ]
  }
}

Step 4: Write your pre-tool guardrail script

Your pre-tool script receives a JSON payload on stdin describing the tool call and must output a JSON decision on stdout. If it returns {"decision": "deny", "reason": "..."}, the tool call is skipped — and the reason gets passed into the model's context so the agent can adapt and try another approach.

#!/usr/bin/env python3
import json, sys, re

payload = json.load(sys.stdin)
tool_name = payload.get("tool_call", {}).get("name", "")
args = payload.get("tool_call", {}).get("args", {})

# Block destructive shell commands
if tool_name == "code_execution":
    code = args.get("code", "")
    destructive_patterns = [
        r"rm\s+-rf\s+/",
        r"DROP\s+TABLE",
        r"git\s+push\s+--force",
        r"shutdown",
        r"reboot",
    ]
    for pattern in destructive_patterns:
        if re.search(pattern, code, re.IGNORECASE):
            print(json.dumps({
                "decision": "deny",
                "reason": f"Blocked destructive command matching pattern: {pattern}"
            }))
            sys.exit(0)

# Allow everything else
print(json.dumps({"decision": "allow"}))

If your script outputs unrecognized JSON, plain text, or nothing, the runtime treats it as approval (allow) — so make sure your deny paths always output valid JSON.

Step 5: Write your post-tool cleanup script

Post-tool hooks run after a tool finishes. They cannot block or undo completed actions, but they can auto-format code, run tests, log activity, or trigger pipelines.

#!/usr/bin/env python3
import json, sys, subprocess

payload = json.load(sys.stdin)
tool_name = payload.get("tool_call", {}).get("name", "")
args = payload.get("tool_call", {}).get("args", {})

if tool_name == "write_file" and args.get("path", "").endswith(".py"):
    filepath = args.get("path", "")
    try:
        subprocess.run(["python3", "-m", "black", filepath], timeout=10)
        subprocess.run(["python3", "-m", "flake8", filepath], timeout=10)
    except Exception:
        pass  # Don't fail the hook on lint errors

Step 6: Deploy and test

Mount your project directory as the agent's environment and send a test prompt:

from google import genai

client = genai.Client()

interaction = client.interactions.create(
    agent="antigravity-preview-05-2026",
    input="Create a Python script that lists all CSV files in the workspace and reports their row counts.",
    environment="remote",
    agent_config={
        "type": "antigravity",
        "max_total_tokens": 10000,  # cap the first run
    },
)

print(interaction.output_text)
print(f"Status: {interaction.status}")

If the agent tries a destructive command, your gate script denies it, and the agent sees the rejection reason and adapts. If it writes a Python file, your auto-format hook runs Black and Flake8 automatically.

---

How to Use Token Budget Caps

Token caps prevent runaway costs. Set one on your first run, not your fifth — the pause-and-resume behavior means you lose nothing by capping early.

Scenario	Recommended Cap	Why
First test run	10,000 tokens	See what the agent does with a small budget
Code audit task	50,000 tokens	Enough for a medium repo, not enough to spiral
Multi-file generation	100,000 tokens	Complex tasks need room to iterate
Production scheduled trigger	250,000+ tokens	Set per-task; monitor via Environments API

When the agent hits the cap, it returns status: "incomplete". Resume it like this:

interaction = client.interactions.create(
    agent="antigravity-preview-05-2026",
    input="Continue from where you stopped.",
    environment="remote",
    previous_interaction_id="your-previous-interaction-id",
    agent_config={
        "type": "antigravity",
        "max_total_tokens": 50000,  # fresh budget for the continuation
    },
)

According to Google's agents overview, a single interaction can trigger multiple reasoning loops, typically consuming 100K to 3M tokens. Environment compute is not billed during the preview, so the token cost is the primary cost driver.

---

How to Set Up Scheduled Triggers

Scheduled triggers let an agent run on a cron schedule without any external orchestrator — no Lambda function, no Airflow DAG, no HTTP call needed. Each run reuses the same sandbox, so files written by one execution are visible to the next.

This is powerful for recurring workflows:

• A nightly code analysis that reads yesterday's results and builds on them
• A daily report agent that accumulates context over time
• A scheduled dependency audit that posts findings to a webhook

The trigger binds four things:

1. Agent — which managed agent to run
2. Environment — which sandbox to use (persisted across runs)
3. Prompt — what the agent should do each time
4. Cron schedule — standard Unix cron syntax

Per the official announcement, triggers pause automatically after five consecutive failures — a production-safety mechanism that prevents a broken trigger from silently burning through your budget night after night.

---

HTTP Hooks: Extending Beyond the Sandbox

Hooks aren't limited to scripts inside the sandbox. They also support HTTP handlers that POST the event JSON directly to your own endpoint. This lets you:

• Stream audit telemetry to an external monitoring system
• Enrich decisions with data from your internal APIs (e.g., checking if a file path is in a protected list)
• Log every tool call to a centralized database for compliance

The HTTP handler type sends the event JSON as a POST request from inside the sandbox network. Your server returns the same decision JSON format ({"decision": "allow"} or {"decision": "deny", "reason": "..."}) in the response body.

---

What This Means for You

If you're a developer

Start on the free tier today. Spin up a sandboxed agent, mount a hooks.json file, and see what a compliance gate looks like in practice before committing to a paid tier. Set a token cap on your first run — 10,000 tokens is enough to see what the agent does, and the pause/resume behavior means you can always continue. Use Gemini 3.5 Flash-Lite for simple repetitive loops and Gemini 3.6 Flash for real reasoning tasks. This approach to plugging models into agent frameworks works beyond Google's ecosystem — see our guide on system over model: plugging new LLMs into agent frameworks.

If you're running a small business

Managed agents eliminate the infrastructure barrier. You don't need a Kubernetes cluster, a Docker setup, or a serverless function — one API call provisions the whole sandbox. Use scheduled triggers to automate recurring tasks: a weekly competitor analysis, a daily inventory check, a monthly report compiled from your latest data. The hooks system ensures the agent can't run destructive commands without your approval, which is the safety net most business owners need before trusting an autonomous agent with real tasks. For a broader framework on choosing the right agent architecture, see our agent operating system decision framework.

If you're building production pipelines

The Environments API is your friend. List, inspect, and delete sandbox sessions from code. Recover environment IDs after disconnects. Clean up when your pipeline finishes instead of waiting for the 7-day TTL. The trigger-with-same-sandbox design means you don't need to build a persistence layer — the sandbox IS your state. Pair this with hooks for compliance and max_total_tokens for cost control, and you have a production-ready autonomous agent with guardrails, budgets, and scheduling built into the platform.

---

Pro Tips From Building With Managed Agents

1. Start with an "after" hook that logs. Before building a blocking "before" hook, add a post-tool hook that logs every tool call and its result. Read the log to understand the agent's behavior patterns, then build your before-hook to block things.
2. Use the skills command if you use an AI coding assistant. Google published an NPX skills command (npx skills @google-gemini/gemini-skills with the Gemini Interactions API skill) that teaches your coding assistant to write this API properly instead of guessing.
3. Delete your environments when done. The 7-day TTL is a backstop, not a cleanup strategy. Use the Environments API to delete sandbox sessions when your pipeline finishes.
4. Run a prompt manually before scheduling it. Never automate something you haven't watched work. Run the prompt once, verify the output, then put it on a trigger.
5. Keep free-tier and paid projects separate. Enabling billing on a project kills the free tier on that project. Use one project for prototyping, another for production.

---

Cost Comparison: Free Tier vs Paid

Feature	Free Tier	Paid (Tier 1)
Requests per minute	~15 RPM	150+ RPM
Requests per day	~1,500 RPD	Unlimited
Environment compute	Free during preview	Free during preview
Token cost	Free (rate-limited)	$1.50/1M input, $7.50/1M output (3.6 Flash)
Data usage	Prompts may be used to improve Google products	Not used for training
Best for	Prototyping, learning, small tasks	Production, scaling, compliance

Sources: Gemini API pricing, Gemini API rate limits

---

How Managed Agents Compare to Other Agent Frameworks

Managed agents are not the only way to build AI agents, but they're the only ones where the infrastructure is fully abstracted away. Here's how they compare:

Dimension	Google Managed Agents	Self-Hosted (ADK, LangChain)	Agent OS (Hermes, Antigravity CLI)
Infrastructure	Fully managed by Google	You run the server	You run the orchestration layer
Sandbox	Google-hosted Linux container	Your own	Varies
Cost controls	Built-in (max_total_tokens)	DIY	DIY
Scheduling	Built-in triggers	External (cron, Airflow)	Varies
Hooks/guardrails	Built-in (hooks.json)	DIY	Varies
Free to start	Yes (free tier)	Yes (open source)	Yes (open source)
Best for	Zero-infra autonomous agents	Full control, custom stacks	Multi-agent orchestration

If you want to explore the agent OS approach, our guide on building a free AI agent operating system covers a 5-layer stack with free tools, and our walkthrough on Google Antigravity 2.0 as an agent OS shows how to configure projects, memory, skills, and hooks in the broader Antigravity ecosystem.

---

FAQ

Q: What is a managed agent in Google AI Studio?

A: A managed agent is an AI agent that Google hosts and runs for you. One API call provisions a Linux sandbox where the agent reasons, writes and executes code, manages files, and browses the web autonomously. The default managed agent is the Antigravity agent (antigravity-preview-05-2026), powered by Gemini 3.6 Flash. You don't manage any servers, containers, or orchestration — Google handles the entire execution loop.

Q: Are managed agents free to use?

A: Yes, managed agents are now available on the Gemini API free tier. You can experiment with agentic workflows using an API key from a project without billing enabled. Standard Flash rate limits apply (approximately 15 RPM and 1,500 RPD). Environment compute is free during the preview period. If you enable billing on a project, the free tier disappears for that project.

Q: What are environment hooks in Gemini managed agents?

A: Environment hooks are custom scripts that run before (pre_tool_execution) or after (post_tool_execution) every tool call the agent makes inside its sandbox. Before-hooks can approve (allow) or block (deny) a tool call — when blocked, the agent sees the rejection reason and adapts. After-hooks run cleanup tasks like auto-formatting code or logging activity. You configure them via a .agents/hooks.json file in the agent's environment.

Q: How do token budget caps work in managed agents?

A: You pass max_total_tokens inside agent_config to cap the total token consumption (input + output + thinking combined) for a single interaction. When the agent hits the limit, execution pauses safely and returns status: "incomplete". The environment state is preserved, so you can resume by passing previous_interaction_id with a fresh budget. This prevents runaway costs on complex multi-step tasks.

Q: Can I schedule managed agents to run on a recurring basis?

A: Yes. Scheduled triggers bind an agent, an environment, a prompt, and a cron schedule into a persistent resource that fires automatically. Each run reuses the same sandbox, so files persist across executions — the agent builds on its own previous work. Triggers pause automatically after five consecutive failures to prevent silent budget burn.

Q: What models can I use with managed agents?

A: The Antigravity agent supports three models: Gemini 3.6 Flash (gemini-3.6-flash, the default), Gemini 3.5 Flash (gemini-3.5-flash), and Gemini 3.5 Flash-Lite (gemini-3.5-flash-lite). You select a model by passing agent_config.model when creating an interaction or managed agent. Gemini 3.6 Flash is the balanced default for reasoning, coding, and tool use; Flash-Lite is the lowest-latency, lowest-cost option.

Q: How long do managed agent sandbox environments last?

A: Sandbox environments have a 7-day TTL by default. You can use the Environments API to list, inspect, and delete sandbox sessions programmatically, so you can clean up when your pipeline finishes instead of waiting for the automatic expiry. You can also reuse an existing environment ID to restore a previous session's exact state.

---

Sources

• Gemini API Managed Agents: 3.6 Flash, hooks, and more — Google Blog, July 28 2026
• Hooks | Gemini API | Google AI for Developers — Official hooks documentation
• Agents Overview | Gemini API — Official agents overview (pricing, limits, security)
• Environments in Managed Agents — Official environment documentation
• Gemini API Pricing — Free tier and paid tier pricing
• Gemini API Rate Limits — RPM, TPM, and RPD limits per tier
• Gemini 3.6 Flash Model Card — Google DeepMind, July 21 2026
• Gemini API Release Notes / Changelog — May 19 2026 managed agents launch
• Agents in AI Studio Playground — Visual playground documentation
• Managed Agents in Gemini API — Google AI Studio managed agents page

---

Updates & Corrections

• 2026-08-02 — Article published. All features verified against Google's official documentation and blog announcement dated July 28, 2026. Pricing limits and model availability are volatile and should be re-verified monthly.

---