Jack Wotherspoon, DevEx engineer at Google DeepMind, told an AI Engineer audience that managed agents now start with a single API call. He demoed Gemini managed agents, where setting environment equals remote in the Interactions API spins up an anti-gravity harness inside a sandbox on Google Cloud infrastructure, with built-in file tools and Google Search plus your own MCP servers, and lets you upload agent skills or a GitHub repo on startup. The affected surface is the Gemini API and that ephemeral file system, and Wotherspoon framed the attacker requirement as remote, because secrets are held outside the sandbox behind a proxy.
The proxy is the pitch.
Wotherspoon said the sandbox never sees a real token. Instead a placeholder sits in the environment and the proxy injects the credential only when the agent calls an external API, so a compromised or curious agent cannot exfiltrate a GitHub token and wander. He showed the same isolation applied to uploaded skills, agents.md and triggers that wake an agent on a schedule to scan Jira or mail and post a webhook to Slack. He did not detail revocation, rotation or audit logging for those injected credentials, and he did not show what the sandbox actually enforces if a tool call is hijacked.
The primitives that make that model usable are split on purpose. Wotherspoon described interactions as the conversational turn state and environments as the persistent file system, so one agent can save metrics.json to an environment and a second agent can reuse that environment ID with a fresh context window. He ran three agents against the same sandbox in sequence, an SEC filing researcher on Nvidia, a quant agent that computed forecasts into an md file, and a reporter that turned the output into a PDF, then showed the same pattern embedded in an app that reads receipts from Drive and renders a visualization. He noted you can swap models in the agent config, from Gemini Flash for speed to Gemini 4 Argon, which he said launched the prior day with a shared 1 million token limit for input, thinking and output and strength in financial analysis.
That packaging matters because Google has been moving agent runtime from self-hosted containers to a hosted platform. Google documents describe the Gemini Enterprise Agent Platform as a unified platform to build, deploy, govern and optimize agents as an evolution of Vertex AI, with support for more than 200 models and data connectors. Wotherspoon positioned managed agents as the lighter, API-first path to the same idea: no VM, no firewall rules, just interactions.create with agent equals anti-gravity. Against DIY sandboxes and against that heavier enterprise platform, the lever is not capability but operational cost, one call versus harness engineering.
Wotherspoon acknowledged the sandbox does code execution and file writes for you, then offered tips for fan-out, saving a tuned workflow via agents.create and reusing it by ID, and linking triggers for daily briefings. What he left open is the question every team will ask before they put customer data in environment equals remote: how does that proxy handle scoped, short-lived OAuth for third-party MCP tools under concurrency, and what does scale pricing look like when every user action fans out to three managed agents writing files you may need to retain.
