Antigravity Plugins, Plan Review and Sandboxing: What Agencies Should Set Up This Week

Antigravity plugins got a home in Google’s agentic coding app on September 28, 2026. Version 2.18.1 added a place to find, install and manage them, and it is the change agencies should look at first. A plugin can add skills, subagents, rules, MCP servers and hooks to the agent in one install. That is useful, and it is also a new way for someone else’s code to run on your machine.

Google shipped seven Antigravity releases between September 15 and September 30. This piece walks through the four changes that matter most for agencies and CMS developers working on WordPress and Drupal sites: plugins, plan review, the Windows sandbox and the permission fixes. It ends with a short setup list.

The short version: treat Antigravity plugins like WordPress plugins from an unknown author. Install them at the project level, read what they contain, and watch for hooks. Turn on plan review for client work. Check that the sandbox is on, especially on Windows machines. And note that Claude Opus 5.5 is in Antigravity now, but not for Enterprise accounts.

What shipped between September 15 and September 30

Everything below comes from Google’s Antigravity changelog, read on October 6.

One release tracker describes 2.14.0 as a new permissions system. The changelog entry for that release only renames the settings section to "Global Permissions." We could not tie a new permission system to that version.

If you are new to the product, start with our Google Antigravity 101. If you are deciding between Google’s two build tools, see Google AI Studio vs Google Antigravity.

What Antigravity plugins can contain

Google’s plugins documentation says a plugin packages skills, subagents, rules, MCP servers and lifecycle hooks into one asset. In practice, a plugin is a folder. It can hold:

• Skills, as folders with a SKILL.md file.
• Subagents and persona settings.
• Rules and style guidelines.
• MCP servers, declared in mcp_config.json.
• Hooks, declared in hooks.json.

Antigravity plugins install in one of two places. Workspace plugins go in .agents/plugins/ at the project root. Global plugins go in ~/.gemini/config/plugins/ and apply to every workspace. You can install from the marketplace in the Customizations tab, the /plugin command, the agy plugin commands in the CLI, or by copying a folder in.

The marketplace for Antigravity plugins has curated shelves. Google’s own plugins cover Firebase, Android, Flutter, Chrome DevTools and BigQuery. The marketplace also lets you install from a local directory.

The plugins page also says plugins installed in the app are automatically updated and shown in the CLI. It does not say whether you can pin a version or turn updates off.

Why Antigravity plugins are a supply-chain question

Hooks are the part to read closely. Google’s hooks documentation says hooks run scripts or shell commands at set points: before a tool runs, after it runs, before and after each model call, and when the agent stops. A plugin can ship hooks. The page does not say whether hooks run inside the terminal sandbox.

MCP servers are the second part of the risk in Antigravity plugins. An MCP server is a program the agent can call. A plugin that declares one is asking to run that program for you.

Google’s own plugin format is clear about what it does not cover. Its August Agent Plugins announcement says the format "defines no install mechanism, no distribution protocol, no permission model, no sandboxing requirements, no trust or provenance verification, and no user experience." Those jobs fall to the app and to you.

Agencies already know this pattern from WordPress. A plugin with good reviews can change owners, and an update can change what it does. Our October 6 piece on Plugin4Shell showed that a pinned coding-agent plugin is not always pinned. The same care applies to Antigravity plugins. We covered the cost and permission side of MCP in Google Antigravity and MCP, and the CI credential side in our post on the npm supply chain.

As of October 6, Google’s enterprise overview does not describe an admin control for blocking or allowlisting plugins. If you manage a team, plan on a written rule until one exists.

Plan review before the agent writes code

Version 2.17.0 added a /plan command. The agent drafts a plan you can read and edit before it writes any code. The changelog says the Agent setting that governs this is now called Plan Review Policy. It has three choices: review every plan, review only when the agent judges it worthwhile, or skip review.

Google’s artifact review page still describes two choices, "Request review" and "Always proceed," and marks Request review as recommended. The docs may lag the app. Check the setting in your own build.

For client work, review every plan. A plan is cheap to read and cheap to change. Code written against the wrong plan is not. Plan review helps most on work that touches many files at once:

• Theme and module upgrades, where one wrong assumption repeats across dozens of files.
• Database changes, such as WordPress custom tables or Drupal update hooks.
• Anything near forms and payments, where a quiet change can break a donation or registration flow.

Two related changes help here. Rules now get their own 20,000-token budget, so a long house style file no longer pushes skills and subagents out of context. And the changelog says repository customization settings now load from /.gemini/config.json. Review that file in any repository you clone, the same way you review a composer.json or package.json.

The sandbox, now on Windows

Version 2.15.1 added file and network sandboxing on Windows. That matters for agencies with mixed teams, where some developers run local WordPress and Drupal sites on Windows laptops.

Google’s sandbox documentation describes what the sandbox does. Anything not mounted is invisible to agent commands. Files such as ~/.ssh and .env are blocked. Network access is limited to domains you have approved. On macOS and Linux, the sandbox is on by default.

Windows is still different. The sandbox page says Windows follows its own configuration rules, and that a future release moves it to the unified permission system. If your developers use Windows, check their settings by hand. Do not assume they match a Mac.

Version 2.16.0 added a WSL section to Application Settings on Windows. It lets the app connect to an installed WSL distribution. Some PHP developers on Windows run their local stack in WSL, and this setting connects the app to that environment. Test the sandbox in that setup before you rely on it.

Permissions: a fix worth checking for

The 2.18.1 release fixed an issue where files in .git, .env and .vscode folders could be changed without a permission prompt. It applied under the Default and Request Review presets. If anyone on your team is on an older build, update.

The permissions documentation describes rules for terminal commands, file reads and writes, web access and MCP tools. Conflicts resolve in a fixed order: deny, then ask, then allow. On macOS and Linux there are three presets: Default, Request Review and Turbo. Default runs commands in the sandbox with workspace-only file access and no network.

The docs give two deny rules worth copying: write_file(.git/) and a write block on your .ssh folder. For CMS work, add wp-config.php, settings.php and .env to your own list.

Version 2.14.0 also opened the integrated terminal and Git version control to Enterprise and Business accounts. Teams on those accounts now get the same terminal exposure as individual users, so the same permission rules apply to everything the agent runs, including work started by Antigravity plugins.

Claude Opus 5.5 in Antigravity: which plans

As of October 6, Google’s models page lists Claude Opus 5.5 and Claude Sonnet 5.5, both in thinking mode. They are available on Google AI Pro and Google AI Ultra. The Pro access is for non-trial subscriptions only. The table does not list them for Free, Google AI Plus or Enterprise.

The same page says Claude Sonnet 4.6, Claude Opus 4.6 and GPT-OSS-120b will be removed on November 2, 2026. If a teammate relies on one of those, plan the switch now. Our Claude Opus 5.5 overview covers how the model behaves and what it costs on the API.

For agencies, the split matters. A developer on a personal Pro plan may see Claude models that a colleague on an Enterprise account does not. Write down which model each project uses, so results can be repeated.

What to set up this week

1. Update everyone to 2.18.1 or later to get the .git, .env and .vscode permission fix.
2. Set Plan Review Policy to review every plan for client repositories.
3. Confirm the sandbox is on on every machine, and check Windows settings by hand.
4. Add deny rules for .git, .ssh, .env, wp-config.php and settings.php.
5. Install Antigravity plugins at the workspace level, not globally, until you trust them.
6. Read each plugin folder before use. Look at hooks.json and mcp_config.json first.
7. Keep a team list of approved plugins and who approved them.
8. Review .gemini/config.json in any repository you clone.
9. Record the model per project, and move off models retiring November 2.

If you also call the managed Antigravity agent from code, our guide to the Antigravity Agent 09-2026 migration covers the API side.

Frequently Asked Questions