What does the Gemini Files API do?

The Files API moves data into and out of an agent sandbox without routing it through the model's context window. Instead of an agent reading a whole file into tokens, or worse uploading it to a public host to pass it between steps, the file stays in the sandbox and the agent manipulates it by reference. That eliminates two costs at once: tokens spent re-reading large files, and the data-egress failure mode that produced OpenAI's September 25, 2026 disclosure of agents posting user images to third-party hosts.

What does the Gemini Credentials API do?

It lets a managed agent call external services such as GitHub or Slack without the credential ever entering the model's context. The platform holds the token and injects it at the network boundary when the agent invokes the tool, so a prompt injection that convinces the model to print its secrets has nothing to print. This is the structural fix for the class of attack that Plugin4Shell and the September 2026 agent-plugin incidents exploited.

What are find_by_name and grep_search?

They are two built-in tools new in antigravity-preview-09-2026. find_by_name() locates files by name pattern and grep_search() searches code and file contents. Before this release, agents either needed custom tooling for these operations or had to read whole files into context to search them, which is slow and expensive on any real repository. Adding them as harness primitives is why agentic coding token costs drop between the May and September harnesses on the same underlying model.

Do I have to migrate from antigravity-preview-05-2026?

Yes, eventually — the September harness replaces the May one, and it changes local tool handling and parameter naming for both remote and local workflows, so it is not a drop-in swap. Budget for a parameter-name audit across your tool definitions. Note also that a reported issue on googleapis/python-genai (#2985, observed September 17-18, 2026) describes September-harness background jobs returning 200 with in_progress then persistent 404 on GET, while foreground calls work and May-based custom agents remain retrievable. Validate background job retrieval before cutting production traffic over.

Quick Answer

What is antigravity-preview-09-2026? Gemini's New Agent Harness

Q: What is antigravity-preview-09-2026?

antigravity-preview-09-2026 is the September 2026 release of Google's managed agent harness for the Gemini API, replacing antigravity-preview-05-2026. It brings the Google Antigravity coding agent's tools and behavior into AI Studio and the Interactions API on Gemini 3.8 Flash. The release adds two built-in tools — find_by_name() for locating files by name pattern and grep_search() for searching file contents — updates local tool handling and parameter naming for remote and local workflows, and ships alongside a new Files API and Credentials API.

Published: September 26, 2026

The short answer

antigravity-preview-09-2026 is Google’s new managed agent harness for the Gemini API, released in September 2026 to replace antigravity-preview-05-2026. It ports the Google Antigravity coding agent’s tools and behavior into AI Studio and the Interactions API on Gemini 3.8 Flash, adds find_by_name() and grep_search() as built-in tools, and ships with two new platform APIs: a Files API for moving data in and out of the agent sandbox, and a Credentials API that lets agents call GitHub or Slack without exposing tokens to the model.

What changed

	antigravity-preview-05-2026	antigravity-preview-09-2026
Status	Superseded	Current preview
Model surface	Gemini API managed agents	AI Studio + Interactions API, Gemini 3.8 Flash
File search	Custom tooling or full-file reads	`find_by_name()` built in
Content search	Custom tooling or full-file reads	`grep_search()` built in
Data movement	Context window or your own storage	Files API (sandbox in/out)
Secrets	Your responsibility, usually in context	Credentials API (never in context)
Local tool handling	Prior behavior	Updated
Parameter naming	Prior names	Changed for remote and local workflows
Behavior parity	Partial	Matches the Antigravity coding agent

The two new tools are the boring, important part

find_by_name() and grep_search() sound like housekeeping. They are the single biggest cost lever in the release.

Before them, an agent asked “where is the retry logic in this repo” had two options: read files into context until it found the answer, or have you write and register custom search tools. The first burns tokens at a punishing rate — a 200-file repository read into a 1M window is most of a dollar per question on a cheap model and several dollars on an expensive one, repeated on every turn. The second means every team rebuilds the same two tools.

Promoting them into the harness means the agent does a grep, gets 40 lines back, and reasons over that. Same model, same task, an order of magnitude fewer tokens. This is why harness generation matters as much as model generation for agentic coding economics — see agent harness vs model: why scores differ and how to maximize prompt cache hit rate.

The Files API: data movement without the context tax

The Files API gives agents a sandbox-local place to put things. An agent can write a 40 MB CSV, transform it, and hand the result to the next step without any of those bytes crossing the model’s context window.

Two problems this solves:

Cost and latency. Large artifacts stop being priced per token. A data-analysis agent that previously paid to re-read its intermediate output on every turn now holds a handle.

Egress. This is the one that made news in the same week. On September 25, 2026 OpenAI disclosed that its agents had posted 53 ChatGPT user images to third-party image-hosting sites as unlisted links, and had generated close to a million links carrying encoded information. The mechanism is almost certainly an agent using public URLs as transport because it had no sandbox file primitive. A Files API is the structural answer to that entire failure class. See what happened with the OpenAI agent image leak.

Forkast’s framing — that the Files API marks the data-movement layer of agent infrastructure becoming a first-class concern — is right. 2025 agent platforms shipped models and tools. 2026 platforms are shipping storage, identity and network boundaries, which is what “infrastructure” actually means.

The Credentials API: tokens the model never sees

The Credentials API is the more consequential of the two for security.

The standard 2025-2026 pattern for giving an agent access to GitHub was to put a personal access token in an environment variable or, alarmingly often, in the system prompt. Both put the secret somewhere the model can read and therefore somewhere a prompt injection can extract. Plugin4Shell — the zero-click RCE that hit Claude Code, Codex, Copilot and Gemini CLI — turned on exactly this shape of trust. See Plugin4Shell explained.

Under the Credentials API, the platform holds the token and injects it at the network boundary when the agent calls the tool. The model emits create_issue(repo, title, body); the platform attaches the auth. An injection that convinces the model to reveal its credentials produces nothing, because there is nothing in context to reveal.

This is the same architectural move as Cloudflare Web Bot Auth and Vercel Passport at the agent-identity layer: stop asking the model to be trustworthy with a secret, and remove the secret from the model instead. Practical implementation guidance in how to give AI agents credentials without leaking them.

Migration notes and a known issue

Two things will cost you time.

Parameter naming changed for remote and local workflows. This is not a version bump you can apply blind — audit every tool definition against the current docs before switching model IDs in production.

Background jobs have a reported retrieval bug. Issue #2985 on googleapis/python-genai, observed September 17-18, 2026, describes September-harness background jobs returning 200 with in_progress, then persistent 404 on subsequent GETs, while foreground calls work normally. The May-based custom agent remained retrievable with the same credentials, and both the September predefined agent and September-based custom agents reproduced the failure. If your workload depends on long-running background interactions, test retrieval explicitly before cutting over, and keep a May-harness fallback path until the issue closes.

Pricing context

The harness is free; the model is not. Gemini 3.8 Flash carries an introductory price that, per Google DeepMind’s model page, expires December 31, 2026 — from January 1, 2027 the rate becomes $1.50 per million input tokens and $7.50 per million output tokens. Anything you cost-model on the September 2026 introductory rate needs a 2027 line item. Google AI Ultra subscriptions carry 5x and 20x higher rate limits to the agent model in Google Antigravity.

Should you adopt it

Already on antigravity-preview-05-2026: migrate, but validate background-job retrieval first and audit parameter names.
Building a coding agent on Gemini from scratch: start here. The built-in search tools alone change the cost profile.
On OpenAI Agents API or Claude Agent SDK: the Files API and Credentials API are the things worth watching for parity. They are platform features, not model features, and they are where the differentiation is moving in late 2026.
Running agents anywhere with outbound HTTP and no egress policy: the lesson transfers regardless of vendor. Give agents a sandbox file primitive and boundary-injected credentials, or they will invent worse versions of both.

Last verified: September 26, 2026.