Runtimes Eat Agents

If You Only Read One Thing

The quiet inversion on 2026-05-21 is that the agent is becoming the least durable object in the stack. Pydantic AI V2 breaks behavior into reusable capabilities; Gemini Managed Agents makes Google's sandbox the loop. Start with Pydantic's V2 beta notes because they show how extension boundaries, not agent classes, are becoming the product.

Pydantic Splits the Agent

The most interesting framework release on 2026-05-21 is not a new agent feature. It is a decision to make the old Agent object less central.

Pydantic AI V2 beta 1 introduces a harness-first design. The core primitive is now a capability: a reusable bundle that can carry tools, lifecycle hooks, instructions, and model settings through one object. The accompanying capabilities documentation frames this as a way to make a memory system, guardrail, or coding toolkit reach every layer of an agent without scattering registration logic across separate arguments. The Harness docs then pull the agent loop into a more explicit composition surface: prompt, model, retries, output, tools, history processing, middleware, and usage policy.

That changes the prior baseline. In V1, a lot of behavior lived on Agent or model settings. V2 moves more of that behavior into portable bundles and a harness layer. The release also makes bare openai: model names use the OpenAI Responses API by default, moves native web tools and MCP URL behavior behind new defaults, and asks users to pass through v1.100.0 first to clear deprecation warnings before adopting the beta.

Why it matters: Agent frameworks are discovering the same thing web frameworks learned years ago: the extension boundary is the product. If tools, instructions, settings, hooks, usage limits, middleware, and output validators all attach in different ways, a team can build a working agent but cannot easily package the behavior that makes it reliable. A capability object says the important unit is not "this agent has a tool." It is "this agent has a reusable operational behavior that travels with the right tool, policy, and instrumentation."

The structural shift is from agent-as-class to agent-as-assembly. That makes Pydantic AI more comparable to plugin systems, middleware stacks, and dependency injection containers than to a chat wrapper. The near-term cost is migration churn. The long-term advantage, if the design holds, is that agent behavior becomes swappable without rewriting the loop. A redaction guardrail, repo-reading toolkit, browser policy, or model-routing bundle can be treated as a component rather than as handwritten glue around one agent instance.

Room for disagreement: This is a beta, and Pydantic explicitly says stable V2 is still ahead. The danger is that the framework spends developer attention on abstractions before the abstractions settle. Still, the direction is credible because it answers a real failure mode in production agents: the behavior that matters most is usually not the model call, but the surrounding package of tools, policy, retries, and state.

Gemini Hosts the Loop

Google's Gemini API is making the opposite move from Pydantic, but toward the same destination. Pydantic decomposes the agent framework; Google bundles the runtime around it.

Gemini Managed Agents give developers a hosted agent harness through a single API call. Google's docs say that call provisions a Linux sandbox where the agent can reason, execute code, manage files, and browse the web. The default Antigravity Agent is powered by Gemini 3.5 Flash and uses the same harness as the Antigravity IDE. Its available tool surface includes shell commands in bash, Python, and Node with stdout/stderr capture, Google Search, URL Context, and filesystem access through the environment.

The important details are operational. Google says a single interaction commonly consumes 100,000 to 3 million tokens; data-analysis tasks can run 300,000 to 3 million input tokens and 30,000 to 150,000 output tokens. The docs estimate 50-70% of input tokens are typically cached, with complex workflows reaching 3-5 million tokens and costs up to about $5. Environment compute is not billed during preview. Environments are deleted after seven days of inactivity, VMs spin down between requests, and the base environment includes Ubuntu with Python 3.12 and Node.js 22.

Why it matters: This is the agent-as-runtime thesis made explicit. A normal model API sells tokens. A hosted agent runtime sells a controlled place for side effects: files can be changed, commands can run, web pages can be fetched, credentials can be mediated, and cached context can make long loops economically tolerable. That is why the token figures matter. Once one job can burn millions of tokens, the product is no longer just the model price sheet. It is the cache policy, sandbox lifecycle, network boundary, and tool surface that decide whether the job is usable.

The security boundary is also unusually visible. Managed agents have unrestricted outbound network access by default, with allowlists available to restrict traffic to domains or wildcard patterns. Credentials can be injected through egress proxy header transformations, and the docs warn that an agent may use any credential it can access. That is the correct level of seriousness: a web-browsing, code-running agent is not a chatbot with extra buttons. It is an automated process with ambient authority unless the runtime narrows it.

Room for disagreement: The preview is still constrained. Antigravity does not support structured outputs, background mode, or several tool families including function calling and MCP in the current docs. That limits how much production orchestration can move into Google's box immediately. But the strategic shape is clear: Google wants the durable surface to be the managed environment, not just Gemini 3.5 Flash.

The Contrarian Take

Everyone says: The 2026-05-21 AI story is model intelligence, because OpenAI's geometry result and Gemini 3.5 Flash dominate the visible conversation.

Here's why that's wrong, or at least incomplete: The practical frontier is shifting to where the agent runs and how its behavior is packaged. Pydantic's V2 beta makes tools, instructions, hooks, and settings portable across harnesses. Gemini Managed Agents makes the sandbox, token budget, cache behavior, and network egress part of the product. The theorem-proving result is a capability signal; these releases are the operator surface that determines whether capability can be run repeatedly without losing state, blowing cost, or leaking authority.

Under the Radar

OpenAI is making private MCP less awkward for enterprises. The OpenAI API changelog added Secure MCP Tunnel for enterprise customers, letting ChatGPT web, Codex, the Responses API, and AgentKit connect to private or on-prem MCP servers through a customer-hosted tunnel client without exposing those servers to the public internet. Mainstream coverage treats MCP as a developer protocol; the missed angle is that private network reachability is becoming part of agent distribution.
Google's CLI migration is a distribution-trust story. The Google developer blog says individual and free users must move from Gemini CLI to Antigravity CLI before Gemini CLI stops serving requests on June 18, 2026, while enterprise customers keep existing access. Simon Willison's read is sharper: an Apache-licensed TypeScript CLI is giving way, for subscription-plan users, to a closed-source Antigravity path.

Quick Takes

Claude Code turned code review into an effort-controlled command. Claude Code 2.1.146 renamed /simplify to /code-review with optional effort levels, stopped auto mode from suppressing AskUserQuestion when a user or skill relies on it, and fixed MCP pagination dropping results after page one. The pattern is that review, clarification, and MCP listing are becoming agent-loop primitives, not UI polish. (Source)
Cline is optimizing the local runtime host, not the pitch deck. Cline CLI v3.0.9 loads sandboxed plugins concurrently, caches plugin tool descriptors per plugin/provider/model, restores fuzzy ranking for @ mentions, and keeps the interactive session alive after task cancellation. Those are small changes with a clear theme: agent CLIs are competing on restart, cancellation, and tool-discovery latency. (Source)
Pydantic fixed a narrow but real AI-ingestion security edge. Pydantic AI v1.100.0 documents a fix for an SSRF cloud-metadata blocklist bypass involving IPv6-encoded address forms, affecting apps that explicitly allow local FileUrl downloads from untrusted input. The point is not the severity for most users; it is that agent frameworks now sit close enough to web ingestion that URL normalization bugs become AI-runtime bugs. (Source)

The Thread

The thread is that agent systems are moving their moat out of the prompt. Pydantic is packaging behavior so the harness can be assembled from reusable capabilities. Google is hosting the environment where side effects occur. OpenAI is tunneling private tools into agent products. Claude Code and Cline are polishing review, questions, pagination, plugin loading, and cancellation because these are the places where long-running agents actually fail. The model still matters, but the durable product is increasingly the boundary around it.

Predictions

New predictions:

I predict: By 2026-08-31, at least two agent frameworks among Pydantic AI, LangGraph, Vercel AI SDK, Google ADK, and OpenAI Agents SDK will expose reusable bundles that combine tools, instructions, model settings, and lifecycle hooks behind one named capability or plugin primitive. (Confidence: medium; Check by: 2026-08-31)
I predict: By 2026-09-30, at least two hosted agent platforms beyond Gemini Managed Agents will publish per-job token-budget guidance, cached-token share estimates, or default egress-control guidance for sandboxed agents. (Confidence: medium; Check by: 2026-09-30)

Generated: 2026-05-21 03:46 EDT