What changed
Google updated Managed Agents in the Gemini API on July 28, 2026. Gemini 3.6 Flash becomes the default, while developers can pin Gemini 3.5 Flash or Flash-Lite. The release adds operational controls on top of background tasks and remote MCP connectivity.
New controls
- Environment hooks run custom scripts before or after sandbox tool calls. Regular-expression matchers can block or audit file writes and code execution, or run linting afterward.
- A pre-execution hook can deny a call and return its reason to the model context.
- `max_total_tokens` caps combined input, output, and thinking usage. The run pauses at the limit while preserving environment state.
- Scheduled triggers bind an agent, environment, prompt, and cron schedule, reusing the same sandbox.
- Projects without active billing can experiment through the free tier.
Why it matters
Production background agents need more than model quality: builders must control actions, spending, and audit points. Hooks and budgets provide native guardrails, but remote MCP tools, networks, credentials, and persistent files also expand the trust boundary.
Limits
Managed isolation does not replace organizational authorization and approvals. Teams should test hook failures, incomplete matchers, retained credentials, and duplicate scheduled runs. High-impact changes, purchases, or deployments still need human approval and a recovery path.