Antigravity brings local models to its agent SDK

Google’s Antigravity SDK can now run agent workflows with local models, giving teams another way to work with code without sending every model request to a cloud service. The operational question moves closer to the workstation: what can the agent do with the files and credentials it finds there?

The September 23 announcement introduces local workflows with Gemma 4 26B A4B through LiteRT and recommends a machine with more than 24 GB of VRAM or unified memory. Google also describes support for OpenAI-compatible local servers, including Ollama and vLLM. Its hybrid demonstration uses a cloud planner with local execution; filenames and task descriptions still go to that planner.

Model location and action permission are separate decisions

Approve a bounded action against a defined state, even when the model runs locally. That principle, developed in our production-agent guidance, changes the first evaluation question. A local model may be a suitable reader of an approved repository without being an approved writer to that repository, a ticketing system or a production account.

The SDK README documents read-only defaults and policies for denying, allowing or requiring approval for tools. These controls deserve inspection before copying a working demonstration into a company workflow. Installation also requires the published package’s runtime binary; cloning the repository alone is insufficient.

Start with a workflow whose effects can be inspected

In a hypothetical repository audit, the local agent reads source code and proposes a patch. Its shell inherits a cloud credential from the developer’s environment. Even if inference stays offline, permitting an arbitrary command could introduce a separate path to external systems. Review the tool’s access and environment as part of the proposed action, rather than treating the model’s location as sufficient approval.

A useful first evaluation can use a disposable repository copy with synthetic secrets, no production credentials and a known defect. Record which files were read, what changed and whether the existing tests and an independent defect check agree. If the agent needs to send a result elsewhere, make that transmission a separately scoped action with a named destination.

If policy prohibits filenames or task descriptions from leaving the machine, the demonstrated hybrid planner is outside that boundary. Use a fully local workflow whose dependencies and network behavior have been checked, or postpone that use case. The narrower pilot can still answer whether local inference produces useful review work on the hardware available.

Google’s release makes local execution an available option. Decide which work to delegate by the permitted action and its observable result. Downloading a model does not settle that decision.