Google Antigravity Explained: From Beginner to Expert (2026 Update)

Key Takeaways

• Google Antigravity replaces the "AI in a sidebar" model with two surfaces: an Editor View for hands-on work and an Agent Manager for running and supervising several agents at once.
• Its standout idea is Artifacts, reviewable receipts like plans, task lists, screenshots, and browser recordings that let a human verify agent work at a glance instead of reading raw logs.
• Antigravity 2.0, launched at Google I/O on May 19, 2026, added a standalone desktop app, a CLI, an SDK, an enterprise tier, dynamic subagents, and Gemini 3.5 Flash as the default model.
• Autonomy is a dial, not a switch, and 2026's prompt-injection incidents (data theft and remote code execution that Google later patched) proved why those guardrails matter in production.
• The transferable playbook for any customer-facing agent comes down to three levers: permissioning, mandatory review, and isolation, the same principles behind human-in-the-loop AI support.

An agent can now write a feature, run it in your terminal, open a browser to test it, catch its own bug, and fix it while you watch. That is what agentic coding tools promise, and Google Antigravity is Google's build of it.

The limits and the risks showed up fast. Through early 2026, developers pushed back on Antigravity's rate caps, reporting that quotas which used to refresh every few hours had tightened into weekly limits that stalled their work.

Security researchers found something worse: a booby-trapped file could hijack the agent and run code on a developer's machine.

An agent that acts is more useful than one that only suggests. It is also riskier the moment it takes a step nobody reviewed.

For support and operations teams building human-in-the-loop AI, Antigravity raises a sharper question: what should we copy when we point agents at real customer systems?

What Is Google Antigravity?

Google Antigravity is an agent-first development platform where you delegate whole tasks to autonomous AI agents. Instead of typing code with an autocomplete helper, a developer assigns an objective, and agents plan the work, execute it across the editor, terminal, and browser, then verify the result.

It is a heavily modified fork of Visual Studio Code.

Google announced Antigravity on November 18, 2025, alongside Gemini 3, and released it in public preview the same day. It runs on macOS, Windows, and Linux, and it was free during preview.

Model choice matters here. Antigravity runs Google's Gemini models, and it also supports Anthropic's Claude Sonnet 4.6 and Claude Opus 4.6, plus OpenAI's open-weight GPT-OSS-120B.

There is even a public debate about its lineage, with some arguing it forks Windsurf, itself a fork of VS Code. Either way, the interface will feel familiar to anyone who has used a modern code editor.

The Core Loop: Plan, Execute, Verify

Most AI coding tools optimize for speed. The pitch is "write faster." Antigravity optimizes for outcomes instead. The pitch is "finish the task."

The agent workflow follows three steps. First it plans the work, laying out what it will do and why. Then it executes, editing files and running tools. Finally it verifies, checking that tests pass and the behavior is correct.

That last step is where agentic systems earn or lose trust. Anyone who has merged a "looks right" fix that quietly broke in production understands why verification cannot be optional.

A concrete example: the agent writes a new component, launches the app in the terminal, opens it in a browser, and confirms the component renders before calling the task done.

Two Surfaces That Match How People Work

Antigravity is organized around two primary surfaces, and that split is a deliberate design choice. It lets a developer move between doing the work and directing the work without switching tools.

Editor View (hands-on mode)

The Editor View is a familiar AI-powered IDE with tab completion and inline commands. This is the synchronous mode, the one a developer reaches for to drive the code directly. Nothing here will surprise a Cursor or VS Code user.

Agent Manager (mission-control mode)

Open Antigravity and you often land in the Agent Manager first. Google calls this the manager mindset: assign work, monitor progress, and review outputs.

It is built for asynchronous operation, where several agents run in parallel without a human babysitting each one.

Steal the lesson: give people both control modes, and let them switch instantly.

Artifacts: The Trust Layer Most Agent Products Miss

Do not ask a human to trust agent output blindly. Hand them proof they can review in seconds.

Antigravity calls that proof Artifacts. These are tangible deliverables the agent produces as it works: implementation plans, task lists, verification walkthroughs, screenshots, and browser recordings. Instead of scrolling through raw tool calls, a reviewer reads structured outputs.

Raw logs do not scale. They are too detailed, too slow to audit, and too easy to misread when work moves fast. Artifacts are the alternative, and they double as a record of what happened.

The workflow goes one step further. A reviewer can leave feedback directly on an Artifact, similar to commenting on a document, and the agent folds that input in without stopping its flow. Correcting direction no longer means restarting the whole task.

Autonomy Is a Dial, Not a Switch

Agents get risky the moment they can take actions, so Antigravity treats autonomy as a core setting rather than an afterthought. During setup it defines a Terminal Execution Policy with three modes.

• Off. The agent never auto-runs terminal commands, except allowlisted ones.
• Auto. The agent decides, and prompts for permission when it needs it.
• Turbo. The agent always auto-runs commands, except denylisted ones.

A matching Review policy governs Artifacts, ranging from Always Proceed (the agent never asks) to Agent Decides to Request Review (the agent always asks).

Together these controls let a team pick a risk posture and raise or lower it as confidence grows. The choice is no longer just "manual" or "wild west."

Browser-in-the-Loop and Safe-by-Default Browsing

Antigravity can drive Chrome as part of its workflow. A browser subagent opens and controls pages, extracts information, automates tasks, and captures screenshots or recordings for verification.

It runs in an isolated, Antigravity-managed browser, so agent activity stays separate from normal browsing.

Safety is built into the defaults. The allowlist starts with localhost, and navigating to a non-allowlisted URL triggers a prompt with an "always allow" option that adds the site to the list.

The safe behavior is the default, and risky expansion takes an explicit click. The moment an agent can browse, it can also meet hostile content.

What's New in Antigravity 2.0

Antigravity changed a lot after its 2025 preview. On May 19, 2026, at Google I/O, Google shipped Antigravity 2.0 and turned a single app into an ecosystem.

• Antigravity 2.0 desktop app. A standalone application built as a central home for agents. It orchestrates multiple agents in parallel, adds dynamic subagents that split a big task into smaller ones, and runs scheduled tasks for background automation. It also integrates with Google AI Studio, Android, and Firebase.
• Antigravity CLI. A terminal-first surface for people who would rather not open a GUI. It spins up agents instantly, and Google is steering Gemini CLI users toward it.
• Antigravity SDK. Programmatic access to the same agent harness that powers Google's own products, so teams can define custom agent behaviors and host them on their own infrastructure.
• Managed Agents in the Gemini API. One API call spins up an agent that reasons, uses tools, and runs code in an isolated Linux environment, powered by the Antigravity harness.

The default model also changed. Gemini 3.5 Flash now leads, and Google says it beats the older Gemini 3.1 Pro on almost every benchmark and runs about four times faster than other frontier models.

Speed matters for agents, which do real work rather than generate a paragraph and stop.

The Security Reality: Prompt Injection, Exfiltration, and RCE

An agent that can browse, run commands, and read files is capable. It is also a target. Through early 2026, security researchers showed how that access could be turned against a user.

The core problem is prompt injection. A large language model cannot reliably tell trusted instructions apart from untrusted content it reads.

Researchers demonstrated indirect prompt injection, where a poisoned document or web page carried hidden instructions, and showed attacks that could steal data or run code.

In one case, Pillar Security found that malicious input to Antigravity's file-search tool could bypass its Strict Mode sandbox and reach full code execution. Google fixed that flaw in late February 2026, after responsible disclosure in January.

Pillar's researcher put it plainly:

The trust model underpinning security assumptions, that a human will catch something suspicious, does not hold when autonomous agents follow instructions from external content.

-

Antigravity remains usable. Running any capable agent safely means least privilege, mandatory review on consequential steps, and isolation, which is the posture Helply builds into its safety and security foundation.

How Antigravity Compares to Cursor and Claude Code

The 2026 field also includes Cursor, Claude Code, and OpenAI's Codex, and model quality across them has largely converged.

Once the engine stops being the differentiator, the harness, the workflow, and the approval model decide the winner.

In practice, Cursor suits developers who want a polished daily editor, Claude Code suits people who live in the terminal, and Antigravity suits work you want to run in parallel and supervise from a control panel.

Choose on workflow fit, not benchmark scores.

Pricing and Practical Constraints

Antigravity launched free in public preview, with generous rate limits on Gemini 3 Pro. Through 2026, access moved onto Google's AI plans.

The Pro tier sits around $20 a month for people who live in the IDE, and higher-volume Ultra tiers cost more, including a $100-a-month Ultra plan introduced at I/O with a much higher Antigravity usage limit.

Prices and limits change often, so confirm the current numbers on Google's own pricing page before relying on them.

The limits drew a backlash. In early 2026, users protested when previously generous quotas tightened, with some reporting weekly caps that stopped their work until they bought credits or upgraded.

The complaints carry an operator lesson. Agents consume capacity because they do work, so production reliability is systems design: throttling, graceful degradation, and fallbacks for the moment a limit hits mid-task.

What Operators Should Copy When Deploying Agents

Outside coding, the same playbook applies to any team putting agents near customers. Three levers carry over to any support or operations deployment.

• Permissioning. Start with least privilege. Allowlists and denylists, not open access, decide what an agent can touch.
• Mandatory review. Give humans reviewable receipts, and keep a person in the loop on anything consequential. Artifacts are the model to copy.
• Isolation. Separate profiles and environments so one compromised step cannot reach everything.

Most support teams do not want to build and secure that infrastructure themselves. They want an AI agent that already ships with these guardrails. That is the design behind Helply.

The AI assistant drafts every reply with full account context and keeps a person in control, so the AI makes human agents faster instead of acting alone.

When a task genuinely calls for action, an AI agent takes the step across your stack within the limits you set, and logs every decision it made.

Because Helply is built for B2B, the same account context that sharpens a draft also surfaces churn risk and upsell signals from the same ticket.

The economics fit the philosophy. With outcome-based pricing, you pay only when the AI delivers a result: $0.25 for a drafted reply, $0.50 for an autonomous resolution, $2.99 for a revenue signal like churn or upsell.

If the AI delivers nothing, nothing bills.

Conclusion

Google Antigravity's real contribution is the workflow around the model: permissions, review, and proof, packaged so a human can supervise autonomous work at the right moments.

Every team faces the same arc when it moves an agent from demo to production.

Support teams reach that point first, because the agent is touching customers and revenue from day one.

Helply ships those guardrails by default: least-privilege access, human-in-the-loop drafts with full account context, and a log of every AI action.

You pay only when the AI delivers, $0.25 for a draft, $0.50 for a resolution, so the economics work from the first ticket.