Weekly News - Google I/O 2026 and the agent-first era

Dates are local dates of each announcement or report.

Google's announcements all pushed the same idea: agent-first. In last week's #001 I wrote that the next edge for AI products would probably come from trust design. This week, stronger agents and a matching jump in supply chain risk arrived together.

After last week's TanStack npm attack, this week it was GitHub and PHP packages.

On May 20 (US time), GitHub said a malicious release of the VS Code extension Nx Console (18.95.0) had been installed on an employee's device, leading to a leak of internal repositories. The attacker claimed about 3,800 repositories, and GitHub's investigation roughly matched that number. The leaks were limited to GitHub's internal repositories, and GitHub said customer information stored elsewhere wasn't affected. It added that some customer information, such as support-case records, may be included. Internet Watch · @IT

The malicious release wasn't a fake extension. According to Nx's postmortem, the attacker used credentials stolen from a contributor's machine during the TanStack incident a week earlier to publish through the real account. The release went up on the Visual Studio Marketplace at 12:30 UTC on May 18 and on Open VSX at 12:33, and was pulled at 12:47 and 13:09 respectively. Once activated, it collected npm, AWS and GitHub tokens, SSH keys, .env files and more, and sent them out over HTTPS, the GitHub API, and DNS-based covert channels. Nx postmortem

On the PHP side, four packages from the localization library Laravel Lang were compromised on May 22-23. According to Snyk, the attacker used a leaked GitHub personal access token to repoint release tags to malicious commits, affecting about 700 versions. The planted code ran on every PHP request and went after AWS, GCP and Azure credentials, SSH keys, .env files and more. Packagist pulled the affected versions on May 23. Snyk analysis · The Hacker News

Last week it was npm packages; this week, a VS Code extension and PHP packages. Installing something is increasingly the risk itself.

When one person runs several services like Park Labs, your dependencies and tool chain are the attack surface. Here's what I see as the practical defense: pause auto-updates even if it's a hassle, keep only extensions from publishers you trust, and rotate the API keys and tokens that get targeted most. Since a real publisher account can get hijacked, as with Nx, simply not pulling new versions right away is a defense too.

Google releases Gemini 3.5 Flash

On May 19, Google released Gemini 3.5 Flash as the first model in the Gemini 3.5 series. Google's numbers: 84.2% on the multimodal understanding benchmark CharXiv Reasoning, 83.6% on MCP Atlas, and output four times faster than other frontier models. As of May 26, Google had said 3.5 Pro would roll out next month (June). Google announcement

Cost is worth a closer look. API pricing is $1.50 input and $9.00 output per million tokens, three times Gemini 3 Flash, and thinking tokens are billed as output. In a call Classmethod ran itself, 1,613 of 2,793 total tokens were thinking tokens. Running Artificial Analysis's Intelligence Index on it cost $1,552, 75% more than Gemini 3.1 Pro. Artificial Analysis · Classmethod

So I put a question mark on the "Flash-like value." What really moves the bill is thinking tokens, which you barely see on a price sheet. Personally, I was more excited about the 3.5 Pro due in June.

Google launches Antigravity 2.0 and schedules the Gemini CLI shutdown for individual users

Antigravity 2.0 is an agent-first development platform. It's made up of a desktop app that runs several agents side by side and schedules tasks, the Antigravity CLI for the terminal, and an SDK for building custom agents. Google says it built the CLI in Go, which makes it more responsive. Antigravity 2.0 · Antigravity CLI · Google Developers Blog

On the I/O stage, Google said 93 subagents running in parallel built a working OS core in about 12 hours, processing 2.6 billion tokens for under $1,000. When DOOM wouldn't run on it because keyboard drivers were missing, the presenter asked by voice and the agent generated the drivers on the spot, and the game ran. These are all figures Google gave on stage. AlphaSignal

The abrupt change drew complaints. On the Google AI Developers Forum, one user wrote that Hub and the IDE had become two separate apps with separate conversation histories, breaking the workflow they relied on, and added that the "Open in IDE" button introduced in 2.0.6 doesn't render on Linux. Google AI Developers Forum

The same day, Google announced it was moving Gemini CLI into Antigravity CLI. From June 18, Gemini CLI requests from Google AI Pro, Ultra and free individual users stop being served. Gemini Code Assist Standard or Enterprise licenses and paid API keys keep working. Agent Skills, Hooks, Subagents and extensions (now Antigravity plugins) carry over, but Google said there won't be 1:1 feature parity at launch. As of May 26, individual users had to migrate before June 18. Google Developers Blog

Google adds a Managed Agents preview to the Gemini API

A single API call spins up an agent in an isolated Linux sandbox. The agent is the Antigravity agent built on Gemini 3.5 Flash: it plans, calls tools, runs code, manages files, and pulls live data from the web. Define instructions and skills in markdown files like AGENTS.md and SKILL.md, and they register as an agent with no separate orchestration code. My one-line version: serverless for agent runtimes. Google announcement · Custom Agents docs

Google announces Gemini Spark, an always-on personal agent

Gemini Spark is a personal AI agent that runs 24/7 on dedicated Google Cloud virtual machines. It keeps working in the background even when you close your laptop or lock your phone. It draws on context from Workspace apps like Gmail and Docs, and you can hand it tasks through a dedicated Gmail address. It's aimed at recurring work like checking monthly bills and subscription receipts, and it's designed to ask first before high-stakes actions like spending money or sending email. As of May 26, a beta for Google AI Ultra subscribers in the US had been announced. The Next Web · Google blog

It's essentially the personal assistant I've been talking about through OpenClaw and Hermes Agent, now built by Google on top of its own services.

Google launches Gemini Omni, starting with video

Gemini Omni combines Gemini's reasoning with Google's generative media models. It makes 10-second videos with sound and lets you keep revising the look, action, camera angle and background by chat. Google says Omni has an intuitive grasp of forces like gravity, kinetic energy and fluid dynamics. Videos made in the Gemini app and elsewhere automatically carry the invisible SynthID watermark. DeepMind · Gemini video generation

Demis Hassabis introduced Omni as a model that "can create anything from any input" and a step toward AGI. He added that Google had spent the past year extending Gemini into a world model that understands and simulates the world. For me, that was the most striking line of this I/O. Decrypt

There are tools on the other side, built to strip SynthID. The open-source remove-ai-watermarks on GitHub says it removes invisible watermarks including SynthID, along with provenance metadata such as C2PA, from images and video. Because it works by regenerating the image, its own README says it can't guarantee every verifier will be fooled (checked October 22).

Google redesigns the Search box and previews information agents

AI Mode's default model switched to Gemini 3.5 Flash worldwide. Google called the redesign the biggest upgrade to the Search box in over 25 years. The new box expands as you type and accepts text, images, files, videos and Chrome tabs. Information agents, which watch the web in the background and flag changes related to your question, were set to arrive first for Pro and Ultra subscribers in the summer. Personal Intelligence in AI Mode expanded to nearly 200 countries and territories in 98 languages, no subscription required. Google Search announcement

Typing a question and getting a list of links really does seem to be on its way out.

Google lets AI Studio build native Android apps

Google AI Studio can now build native Android apps in Kotlin and Jetpack Compose from a single prompt. You preview in an emulator inside the browser, install on a real device over USB, and push to an internal testing track in the Play Console, with nothing to install along the way. The apps use device features like the camera, GPS, accelerometer and Bluetooth through Android APIs. Android Developers Blog · Google AI Studio announcement

Anthropic publishes Project Glasswing's first-month results

On May 22, Anthropic published first-month results from Project Glasswing, the security project it started in April. About 50 partners used the unreleased frontier model Claude Mythos Preview to find more than 10,000 high and critical vulnerabilities. Cloudflare found about 2,000 (about 400 of them high or critical), and Mozilla found 271 in Firefox 150. Scanning more than 1,000 open-source projects produced an estimate of 6,202 high and critical vulnerabilities. Launch partners include AWS, Apple, Google, Microsoft, NVIDIA and JPMorganChase. Anthropic initial update · Project Glasswing

Anthropic says no company has yet built safeguards strong enough to stop models like this from being misused, so it isn't releasing the model publicly and only offers it to trusted partners. As striking as 10,000 in a month is, what stayed with me is that the dilemma of a too-powerful model has become real.

Andrej Karpathy joins Anthropic's pre-training team

Andrej Karpathy, who coined "vibe coding," announced on May 19 that he had joined Anthropic's pre-training team. He's an OpenAI co-founder and led Autopilot at Tesla. An Anthropic spokesperson said he'll start a team that uses Claude to speed up pre-training research. TechCrunch · Karpathy's post on X

An OpenAI model disproves an 80-year-old Erdős conjecture

On May 20, OpenAI announced that an internal reasoning model had disproved a long-standing conjecture on the planar unit distance problem. Paul Erdős posed the problem in 1946, and for nearly 80 years the accepted view was that square grid constructions were essentially optimal. Using algebraic number theory, the model found an infinite family of constructions that beats the square grid by a polynomial factor, and outside mathematicians checked the proof. Princeton's Will Sawin then pushed the same idea further. The result came from a general-purpose reasoning model, not a system built for math. OpenAI announcement

Honestly, I wasn't sure whether to be thrilled or a little scared.

OpenAI adds Appshots, locked-Mac computer use and Goal mode to Codex

Codex is widening from a coding agent into an agent that handles your whole Mac. The May 21-22 update added Appshots: press both Command keys and the frontmost app window goes to Codex with its screenshot and text. If you turn it on, Codex can keep using desktop apps after your Mac locks and take instructions remotely from your phone. Goal mode, which works on its own for hours or even days once you give it a goal, became a full feature. Appshots · Computer use · Follow goals

Codex has been getting noticeably better lately, so I'm using it alongside Claude Code and comparing.

The strongest thought this week: agent-first is becoming the industry default.

Google re-laid everything around agents, from the model (Gemini 3.5) to dev tools (Antigravity), the API (Managed Agents), a personal assistant (Spark) and Search. OpenAI's Codex started handling the whole Mac, and Anthropic's partners used a model to find more than 10,000 vulnerabilities. The direction is the same: AI is moving past executing what people tell it, toward handling the environment directly and running on its own for a long time.

So the questions for a solo builder shift too.

• Which agent platform do you tie yourself to (tools can vanish anytime, like Gemini CLI for individuals)
• How much of your accounts and data do you connect to an always-on agent
• How do you predict invisible costs like thinking tokens
• How do you build the assumption that everything you install or connect is an attack surface into your operations

Powerful agents are clearly leverage for solo operations. But as this week's security incidents show, the bigger the leverage, the bigger the cost of a small mistake. Park Labs will use agents aggressively, but keep the boundaries of permission, cost and trust narrow.

In last week's #001 I said I'd dig deep into only two or three stories from now on. This week Google I/O was so big that I covered I/O in two deep sections and kept the rest short.

I meant to slot in a hands-on comparison of the Antigravity CLI against Claude Code and Codex next week, but I never wrote it. The next weekly, #003, came out 13 weeks later on August 24 (added October 22).