Google Antigravity¶

Google Antigravity is the agentic development platform Google launched on November 18, 2025, alongside the Gemini 3 Pro model release. It is positioned not as a successor to Project IDX or a thin layer on top of an existing IDE, but as a new top-level surface in which agents — not files — are the unit of work (Build with Google Antigravity, Introducing Google Antigravity). Where Claude Code, GitHub Copilot's agent mode, and Cursor still center the developer on an editor pane and treat the agent as a sidekick that occasionally drives, Antigravity inverts the relationship: the developer issues a high-level intent, the platform spawns one or more parallel agents that operate across the editor, the terminal, and a controlled browser, and the human reviews a stream of persisted artifacts that prove what each agent did.

This page covers what Antigravity is, the three surfaces it ships, the artifact and knowledge-base systems that anchor agent execution, its multi-model architecture, MCP integration, the security history that has dogged it since launch, how it compares to the rest of the agent-IDE field, and the limitations a careful user should be aware of in mid-2026.

Origins and the Windsurf-lineage question¶

Antigravity arrived not as a clean greenfield product but as the visible end of a longer corporate manoeuvre. In the summer of 2025 Google paid roughly 2.4 billion USD to licence technology from and reverse-acquihire a substantial part of the engineering team behind Windsurf, the agentic IDE that had spun out of Codeium (Embrace The Red). When Antigravity shipped four months later, the resemblance was hard to miss: a forked-VS-Code substrate, a left-rail chat surface that opens straight into agent mode, an artifacts panel, and several UI affordances that mirrored Windsurf's "Cascade" UX. Independent reviewers and security researchers have repeatedly described Antigravity as Windsurf-lineage in everything but name (Embrace The Red, AI for Developers).

Google's own framing is more careful. The launch posts describe Antigravity as a new platform, built for the Gemini 3 generation, designed from the ground up around long-horizon agent workflows (Introducing Google Antigravity). The two statements are not strictly contradictory — significant new platform code can sit on top of a VS Code fork and an acquired UX language — but the Windsurf-lineage question matters for two reasons. It explains why Antigravity felt mature on day one (a multi-year UX iteration was inherited, not invented), and it puts a footnote on the long-term roadmap: how Antigravity converges with, replaces, or co-exists with the still-shipping Windsurf product is an open commercial question.

The three surfaces¶

Antigravity is best understood as three coordinated surfaces that share state. The Google Developers blog and the architecture deep-dive both describe the same triplet: Editor View, Manager Surface, and Browser Surface (Build with Google Antigravity, SmartScope).

Editor View — the familiar IDE¶

The Editor View is the surface a developer coming from VS Code or Cursor will recognise immediately: a file tree, a tabbed editor, an integrated terminal, language servers, and a chat panel pinned to the side. Agent mode and inline edit live here. A single agent can be summoned to refactor the current file, scaffold a feature across the workspace, or run terminal commands; the developer keeps their hand on the keyboard and reviews diffs the way they would in any other agentic IDE (Introducing Google Antigravity).

Editor View is the surface that anchors synchronous, in-the-loop work. It is not the differentiating part of the product — most of what it does, agent mode in VS Code or Cursor's agent panel will also do — but it is essential infrastructure: even when a user spends most of their time orchestrating from the Manager, they drop into Editor View to inspect a specific change, debug a failing test, or hand-edit a piece of code the agent could not get right.

Manager Surface — the multi-agent dashboard¶

The Manager Surface is the distinctive Antigravity primitive. It is a separate top-level view that lists all currently running agents, the task each one has been assigned, the model selected for that task, the live artifacts being produced, and a status indicator (running, blocked, awaiting review, completed). From here a developer can spawn additional agents in parallel, reassign work, pause an agent that has gone off-track, or merge an agent's branch back into the working tree (Introducing Google Antigravity, AI for Developers).

This is what Google means when it markets Antigravity as "agent-first": the Manager makes parallel autonomous work a routine pattern rather than an exotic capability. A single human can have five agents running concurrently — one porting a service from Python to Go, one writing unit tests against a freshly merged feature, one reproducing a bug filed yesterday, one upgrading a dependency, one drafting release notes — and the Manager is the place where that fleet is visible, comparable, and controllable. Competing products lean on git branches, terminal multiplexers, or external task boards to play the same role; Antigravity bakes the fleet view into the platform.

Browser Surface — the agent-driven browser¶

The third surface is a controlled Chromium instance that agents can drive directly. The Browser Surface is not a normal embedded browser; it is an automation target that the agent uses to log in to a staging site, click through a checkout flow, validate a regression, scrape a dashboard, or capture a screenshot of a UI bug. Every navigation, click, and DOM mutation is recorded as an artifact so the human reviewer can replay what the agent saw and did (Build with Google Antigravity, SmartScope).

This is the surface that most clearly differentiates Antigravity from coding-only agents. Claude Code can shell out to a browser via MCP, and Codex Cloud exposes a headless browser through its sandbox, but neither bakes the browser into the IDE as a first-class peer of the editor and terminal. The Browser Surface turns end-to-end validation — actually exercising the running application — into a routine step the agent can take, not a separate workflow that has to be glued together.

Artifacts — the unit of verifiable execution¶

The architectural keystone of Antigravity is the artifact. An artifact is a persisted, addressable unit of agent work — a plan, a todo list, a diff, a screenshot, a video recording of a browser session, a terminal transcript, a tool-call log, a written report. Every agent task produces a stream of artifacts which together form an audit trail of what the agent did, why, and with what evidence (Build with Google Antigravity, AI for Developers).

This is a deliberate departure from the "one-shot diff" pattern that dominated 2024-2025 coding agents. In a one-shot model the user asks for a change, the agent thinks for a while, and a diff appears; whatever reasoning, tool exploration, or partial validation happened in between is discarded. Antigravity's bet is that for long-horizon work — multi-hour, multi-file, cross-service tasks — the diff is not enough. A human reviewer needs to see the plan the agent committed to, the intermediate checkpoints it hit, the test runs it observed, the browser flows it exercised, and the rationale behind the changes that ended up in the final patch. Artifacts make that review tractable.

Two consequences flow from this. First, agent-to-human handoff becomes meaningful: a reviewer can ask "show me the screenshot of the checkout flow you tested" or "show me the terminal output of the migration script you ran" and Antigravity has the artifact ready. Second, agent-to-agent handoff also works: an artifact produced by a planning agent can be picked up by an implementation agent, and an artifact produced by an implementation agent can be picked up by a verification agent. This is the substrate on which the Manager Surface's parallel-agent pattern actually rests.

The knowledge base and AGENTS.md¶

Antigravity reads a project-level knowledge base of context files that ground every agent session. The central file is AGENTS.md — a free-form Markdown document at the repository root that captures coding conventions, architectural rules, preferred libraries, build commands, deployment notes, and anything else an agent needs to behave correctly on the project (Build with Google Antigravity).

AGENTS.md is not a Google-only invention. The spec was floated as a vendor-neutral analogue to README.md for human readers — a single file that any coding agent could read to bootstrap a project. By late 2025 it had been picked up by Codex, Aider, several Claude Code wrappers, and now Antigravity (AI for Developers). The cross-vendor adoption matters: a project that already maintains an AGENTS.md for Codex or Claude Code gets Antigravity onboarding for free.

In addition to AGENTS.md, Antigravity recognises a wider folder of project context — .antigravity/ for tool definitions, rule files, custom slash commands, and per-agent prompt files. The pattern is familiar: project-scoped configuration wins over user-scoped, both layer on top of the platform default. The exact directory layout has changed in minor releases since launch; the canonical reference is Antigravity's docs site rather than secondary sources (Antigravity Architecture Deep Dive).

Multi-model support¶

Antigravity is not a Gemini-only client. From launch day the model picker has exposed multiple frontier models from multiple vendors, selected per task by the developer or per agent by the Manager (Google Antigravity (Wikipedia), Build with Google Antigravity).

The mid-2026 model lineup, cross-verified across the Wikipedia page and the Google Developers blog, includes:

Gemini 3 Pro — Google's headline reasoning model, the default for most agent tasks.
Gemini 3 Flash — the latency-optimised variant for cheap, fast tool-call loops.
Claude Sonnet 4.5 and 4.6 — Anthropic's mid-tier reasoning models, popular for code-heavy refactors.
Claude Opus 4.6 — Anthropic's top-tier model, used when long-context planning matters most.
GPT-OSS 120B — OpenAI's open-weights model, available for users who want a fully inspectable inference path.

The model picker sits in the agent-creation panel; some teams pin a specific model to a specific agent role (planner uses Opus, implementer uses Gemini 3 Pro, fast-iteration uses Flash). External models route through Google-managed endpoints, which has two practical consequences: latency can be noticeably higher than for Gemini, and an organisation using Antigravity is implicitly trusting Google's plumbing to broker the third-party calls. Pricing — at the public-preview stage — is bundled into Antigravity's free tier rather than billed per token.

MCP integration¶

Antigravity speaks the Model Context Protocol natively. Each user has a configuration file at ~/.gemini/antigravity/mcp_config.json that lists the MCP servers the IDE should expose to its agents (Antigravity MCP Documentation). The schema is the standard MCP JSON shape — a mcpServers object mapping server names to invocation specs — and supports both STDIO transports (a local command the IDE spawns) and HTTP/SSE transports (a network endpoint).

A representative mcp_config.json mixing a local STDIO server and a Google-credentialed HTTP server looks roughly like this:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/home/user/projects"
      ]
    },
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_PAT}"
      }
    },
    "bigquery": {
      "url": "https://mcp.googleapis.com/bigquery",
      "auth": {
        "type": "google",
        "scopes": ["https://www.googleapis.com/auth/bigquery.readonly"]
      }
    }
  }
}

The auth.type: google pattern is Antigravity-specific: it lets an MCP server piggy-back on the user's existing Google login, so the agent can call BigQuery, Cloud Storage, or Vertex AI tools without the user pasting API keys (Antigravity MCP Documentation). For external servers the standard env-passed secrets pattern still applies.

When an agent issues a tool call, Antigravity routes the call to the matching server, captures the result as an artifact, and feeds it back into the model. The artifact retention means that an audit-curious reviewer can trace every external call the agent made.

Security history¶

Antigravity's first six months in public preview have been defined as much by its security incidents as by its product launch. Within twenty-four hours of the November 2025 release, multiple independent researchers published vulnerabilities (Analytics Insight).

The most thoroughly documented disclosure is the November 2025 work from Embrace The Red, which catalogued four flaws in the launch build (Embrace The Red). The headline issue was a prompt-injection-to-exfiltration chain that abused Antigravity's default outbound allowlist: webhook.site was reachable from the agent sandbox, which meant a malicious file or web page processed by an agent could nudge it into POSTing source code or environment variables to an attacker-controlled webhook. The same disclosure identified weaknesses in the trust prompt shown when a project is opened for the first time, gaps in how the browser surface scoped credentials, and an over-permissive default for tool registration. Embrace The Red's framing — that "security keeps Antigravity grounded" — became the public summary of the early posture: the product was fast to ship, slow to harden.

A second wave landed in January 2026 with Pillar Security's disclosure of a sandbox-escape in the bundled find_by_name tool. The escape exploited the fact that Antigravity's wrapper around fd honoured the -X flag, which passes matched filenames as arguments to an arbitrary command — turning a benign-looking search request into a vector for arbitrary command execution outside the agent's intended sandbox scope. Google acknowledged the issue on its Bug Hunters disclosure page for Antigravity, which it maintains as a public catalogue of known issues and their remediation status (Antigravity Known Issues — Google Bug Hunters).

Patches addressing the find_by_name escape and several of the November findings landed in the February 28, 2026 Antigravity update, framed as the first hardening release of the preview cycle (Antigravity Known Issues — Google Bug Hunters). The pattern — fast disclosure, public catalogue, batched patches — is healthy in the sense that the security loop is functioning, but the cadence has also fed the broader critique that Antigravity is best treated as a preview-grade product rather than a tool to point at production code with no scrutiny.

Comparison with the rest of the field¶

Antigravity occupies a specific niche in the mid-2026 agent-IDE landscape, distinguishable from each major competitor on one or two axes.

Cursor is the closest UX neighbour but is fundamentally editor-centric. Cursor's "Composer" runs autonomous edits and tool calls, but it does not have a Manager Surface that fleet-views multiple parallel agents, and it does not bake a controlled browser into the platform. A power-user can approximate Antigravity's parallel-agent pattern by running several Cursor windows side-by-side; the difference is that Antigravity makes parallelism a first-class concept.
GitHub Copilot agent mode runs synchronously inside the editor, and its cloud sibling (the coding agent on github.com) runs on GitHub Actions infrastructure. Neither has the Manager Surface; the closest analogue is GitHub's Agents tab, which lists running cloud sessions but stays inside the issue-and-PR flow. Copilot also leans on the GitHub ecosystem (Actions, Issues, PRs) for the audit trail rather than producing standalone artifacts.
Windsurf is the obvious comparison given the lineage. Windsurf still ships as an independent product with its own subscription, and the visible UX overlap with Antigravity is significant. The differentiators are Antigravity's Manager Surface (Windsurf has Cascade but not a multi-agent fleet view), Antigravity's tight integration with Google identity and the Gemini model family, and Antigravity's free preview pricing.
Claude Code sits at the opposite end of the spectrum: a Unix-shaped CLI plus IDE plugin, with sub-agents, hooks, and Skills as the extension model. Claude Code does not ship a Manager Surface; the developer composes parallelism manually with multiple terminals or via the cloud product. Claude Code's strength is composability and deep configurability; Antigravity's is an opinionated, batteries-included orchestration surface.

The shorthand that fits the field: Copilot is the GitHub-native agent, Codex is the OpenAI-native agent, Claude Code is the composable agent, Cursor is the editor-native agent, and Antigravity is the fleet-native agent (AI for Developers, SmartScope).

Pricing and access¶

At the time of writing Antigravity remains a free public preview (Introducing Google Antigravity, Wikipedia). Access requires a Google account login; there is no waitlist for individual users, and the installer ships for macOS, Windows, and Linux. Regional availability tracks Google's standard model-access rules, with some regions (notably some EU countries during the launch month, since lifted) seeing initial restrictions on the Gemini 3 endpoints.

There is no Enterprise SKU yet. Organisations that want centralised billing, audit log export, custom retention, single-sign-on enforcement, or VPC-scoped MCP servers do not currently have a contracted option; the documented expectation is that Antigravity will eventually offer an enterprise tier and integrate with Google Cloud identity, but as of May 2026 that is roadmap rather than product. Until then, larger teams using Antigravity tend to do so via individual logins, with the security and compliance posture that implies.

The free-preview pricing is also why multi-model support works the way it does: external Claude and GPT-OSS calls are not metered against the user. That is unlikely to survive the move to a paid SKU; the question is how Google will price third-party inference once the preview ends.

Limitations¶

Beyond the security history covered above, a careful user should hold several limitations in mind.

Preview status. The product version is explicitly preview. Configuration formats, model lineups, default tool sets, and even the surface taxonomy have shifted between minor releases. Anything in this page should be treated as a snapshot, not a contract.
Latency on external models. Calls to Claude and GPT-OSS are routed through Google-brokered endpoints. For short tool-call loops the added hop is invisible; for long planning steps it can add noticeable seconds. Teams that pin Opus or Sonnet to the planner role have learned to budget for this.
Sandbox isolation depends on platform patches. The find_by_name and webhook.site incidents both came down to a configuration default rather than a deep architectural flaw, but they illustrate the broader point: the agent sandbox in Antigravity's preview build is hardened iteratively, not by design. Sensitive code or production secrets should not be exposed to an Antigravity session without explicit MCP scoping.
Windsurf-lineage IP questions. Google's commercial arrangement with the Windsurf team appears to be a licensing-plus-acquihire structure rather than a clean acquisition. The legal posture around code, UX, and trademarks is not fully public. Organisations with strict procurement review processes may want to wait for clearer documentation.
Knowledge-base maturity. AGENTS.md is broadly readable but the platform-specific bits — slash commands, custom tool definitions, per-agent prompt files — live in .antigravity/ paths whose schema has been evolving. Cross-vendor portability is real for AGENTS.md, partial for the rest.

Open questions¶

Three questions are worth watching over the next six to twelve months.

The first is long-term roadmap. Will Antigravity stay a discrete product, fold into Project IDX's successor surfaces, or merge with Vertex AI Studio's agent tooling? Google has not committed publicly. The economics of running a free preview on top of frontier models alongside maintaining Windsurf, Gemini CLI, and the Jules agent suggest some consolidation is likely.

The second is the agent-economy posture. Antigravity ships with a free model picker including non-Google frontier models, which is unusual: most platform vendors prefer to push their own models. If Antigravity remains genuinely multi-model when paid SKUs arrive, it could become a default agent harness for teams who want neutrality. If it tightens around Gemini, it becomes a Google-specific tool.

The third is integration with Vertex AI Studio. Vertex AI's agent-building tooling targets a different audience (enterprise prompt engineers, not interactive developers), but the underlying infrastructure overlaps: both produce agents that call Gemini, both have a notion of artifacts, both support MCP. A unified configuration story across Antigravity (developer-facing) and Vertex (operations-facing) would be the natural endpoint; whether Google chooses to ship that is, again, a roadmap call.

Sources¶

Changelog¶

2026-05-11 — Page created from Google primary sources + security disclosures (Type B, confidence 84)