Agents lost their disguise and took over your infrastructure
It became easy to produce software, the hard thing is to produce reliable software. A guide to leaving “vibe coding” behind and orchestrating the new autonomous AI programs that are going to save your architecture.
Hearing the word “agent” made me associate the term with explosive chases from Mission Impossible, 007 saving the world, or spies full of disguises. Today, when I hear “agents”, I think of autonomous and intelligent software programs, capable of reasoning, planning, and executing complex (or not) tasks without needing our intervention at every line of code.
On one hand, the Cloud came to make things easier; on the other, infrastructure gained new layers of complexity. After all, who doesn’t want to make the most of what the cloud offers in security, monitoring, data, governance and resources that eliminate the need for manual development?
The point is that, with every new feature or tool, the system easily turns into a patchwork quilt of fixes with all the duct-taped corrections. The pleasure of designing architectures, solving real problems, and the simple act of coding ended up suffocated by technical debt and toil, a term that SRE (Site Reliability Engineering) uses to name that manual and operational effort that drains engineering teams.
Artificial Intelligence came with the promise of breaking this cycle, and the turning point happened with the boom of models like Gemini and ChatGPT. In the beginning, the market was captivated by vibe coding, the practice of throwing informal prompts into a chat and copying/pasting blocks of code based on trial and error, without major concerns for testing, architecture, or security.
It seemed fun and fast, but the corporate day-to-day showed that using an assistant just as an ‘autocomplete’ didn’t solve infrastructure problems; on the contrary, it made systems accumulate bugs and technical debt at record speed.
With the advancing maturity in the cloud ecosystem, it becomes clear that the real transformation occurs not within a chat window, but when developers move beyond simple prompt engineering to orchestrate autonomous agents and skills to automate entire workflows within a secure environment. The machine isn’t just completing human reasoning in a reactive way, it is designing, orchestrating, and executing complete solutions.
What Separates an Agent from a Chatbot?
It’s very common to think that any chat window running an LLM (Large Language Model, the artificial intelligence models trained to generate text) is an agent, but it isn’t. While traditional models are reactive (responding only to direct queries), autonomous agents are proactive and goal-driven.
To understand how an agent “thinks”, imagine the query to a chatbot: “What’s the best way to get to work today? My knee is hurting.”
A pure language model will use its database to return a generic guess in natural language, full stop.
An Agent, on the other hand, operates on four pillars: a System Prompt (its persona and guidelines), Memory (accumulated history), State (the exact perception of the current context), and Tools (its connection to the real world). Upon receiving the same question, the agent doesn’t answer immediately because it will be guided by an invisible orchestrator that reasons and acts:
- Accesses the Weather tool and sees if it’s raining.
- Consults the Transport API and confirms if the train line is operating normally.
- Reads your Calendar and realizes you have plenty of time.
- Cross-references all these external variables with the clinical information of your knee pain.
Only then, it delivers the final decision: “Take the subway and use the east entrance elevator”. Rather than acting like a basic navigation tool, it dynamically evaluated external variables to make an informed recommendation.
The Speed Trap, “Shift-Left”, and Antigravity
When AI went mainstream, the industry believed that speeding up writing would save systems, but the machine sped up typing, not understanding.
The bugs got deeper and more expensive, and the irony reaches its peak when the token quota runs out in the middle of the afternoon and the developer is left stranded with their reasoning cut in half, staring at the screen not knowing how to continue what the AI started.
It was exactly this “operational hangover” that Ícaro, my Tech Lead colleague at a financial institution, experienced in practice. “In the beginning, we had a lot of fun with vibe coding”, he remembers. However, the illusion of speed quickly faded in the next steps of the process; all the time saved on typing ended up swallowed by exhausting sessions of review, investigation, and correction.
“I realized that the time saved writing code was entirely spent trying to audit the machine’s hallucinations and the new bugs. I stopped being a creator to become a Pull Request reviewer”, Ícaro concludes.
A 2026 report by Faros AI indicates that Pull Request review times increased by 441% with the adoption of AI. In teams without governance, the Change Failure Rate (CFR), an indicator from DORA metrics (DevOps Research and Assessment, Google’s parameter to evaluate delivery maturity) shot up to 11% due to code generated without supervision. AI granted the superpower of writing systems faster, but brought the burden of piling up vulnerabilities in the same proportion.
How do we escape this trap? The key lies not in slowing down innovation, but in providing AI with structured context. It is exactly there that Antigravity changes the dynamic of the game, embracing the Shift-Left Security philosophy.
“Pushing to the left” consists of anticipating security to the beginning of the project’s timeline; in practice, your system is already shielded the instant your finger touches the first key.
Antigravity 2.0 operates like a dedicated security engineer observing every code line of your project. It understands the entire repository, but avoids overloading the AI’s context window. Instead, it applies local governance directories (.agents/rules/ and .agents/skills/) to deliver security policies and corporate standards with surgical precision.
If a query contains a potential SQL Injection vulnerability, the system flags the issue. And this orchestration follows the environment you are in, if the mission is to design an API specification, it acts integrated with Apigee, if the goal is to fish for insights, it breathes inside BigQuery, and so on.
Architecture and security cease to be a patch in the final stretch of the delivery, they are born together with the code.
The Cure against Hallucinations and Leaks
So that precision and security don’t get lost along the way, Google standardized two strategies:
- Privacy by Design: When you connect Cloud Sensitive Data Protection (by API or using resources like Model Armor), it is possible to check and scrub sensitive data before it reaches the AI agent. Through masking or tokenization, the model works only with protected information, guaranteeing the security of your confidential data, thus facilitating compliance with norms like the GDPR.
- Grounding with RAG: To mitigate hallucinations, the model relies on verified internal databases (such as manuals and corporate repositories). Furthermore, the system can be configured to cite the exact origin of the information, guaranteeing much more precise, transparent, and invention-free answers.
GitOps and “Human-in-the-Loop”
Now that the AI is shielded against leaks and hallucinations, the challenge ceases to be data precision and becomes the control of actions. If the code assistants of the past were just reactive co-pilots, Antigravity (led by the Antigravity 2.0 app, powered by its CLI and recently natively embedded in VS Code, JetBrains, and Zed) is your autonomous command center.
Get Guilherme Moreira’s stories in your inbox
Join Medium for free to get updates from this writer.
Throwing an agent into a blank repository and crossing your fingers is not an engineering strategy. The future of development demands that human work stops focusing on writing loose lines and starts defining the rules, the intent, the business limits so that the agent acts within them. But how to trust an autonomous robot writing infrastructure (like Terraform or Docker files) alone? The answer lies in GitOps and Plan Mode.
The doctrine says that “if it’s not in version control, it doesn’t exist”. Antigravity does not modify production environments directly. Prior to execution, it generates actionable Artifacts (like detailed Implementation Plans, interactive Walkthroughs, and Code Diffs), lists exactly what it intends to change, and locks the operation, meaning, the AI doesn’t touch anything unless you, the “technical director”, audit the proof that the code meets the specification and click “Approve”.
Orchestrating the Swarm: Workflow Agents, State, and MCP
The Gemini Enterprise Agent Platform provides a framework for next-generation systems architecture. While business users map agents visually with Agent Studio (a low-code canvas), software engineering trusts the health of the production environment to the Agent Development Kit (ADK), the open-source framework that changes the developer’s mindset from “prompt engineering” to “distributed agent architecture”.
Imagine you need to analyze a complex server crash incident. The amateur dev throws an endless block of raw logs into the generic chat and hopes it works. The engineer fluent in ADK orchestrates Workflow Agents in logical and precise architectural patterns. A Sequential pattern builds a linear production pipeline step by step. A Parallel pattern throws multiple specialist robots to chew through different data sources at the same time.
To support production-grade operations, this AI architecture relies on three core pillars:
See how the ADK orchestrates an agent’s communication with corporate systems in practice, like in this example where an autonomous financial agent cross-references internal data with the outside world:
from google.adk import tools
from google.adk.agents.llm_agent import Agent
# Custom function to simulate enterprise metrics retrieval
@tools.function_tool
def fetch_enterprise_metrics(metric_id: str) -> dict:
"""Fetches enterprise metrics by the metric identifier.
Args:
metric_id: The identifier for the desired metric (e.g., 'Q3_REVENUE').
Returns:
A dictionary containing the status and value of the metric.
"""
# Simulating business data
return {"status": "optimal", "value": 15000000.00}
# Instantiating the agent
agent = Agent(
name="Enterprise_Finance_Agent",
model="gemini-3.7-flash",
instructions=(
"You act as an enterprise financial agent. Respond professionally and cross-reference metrics with current market data."
),
tools=[fetch_enterprise_metrics, tools.google_search],
)
# Execution entry point
if __name__ == "__main__":
result = agent.run(
"Fetch the 'Q3_REVENUE' metric and cross-reference it with current market"
" news."
)
print(result)While Tools connect AI agents to external systems, governance and context are established via Rules and Skills.
The Rules (usually saved in .agents/rules/) are the “house rules”, defining global and non-negotiable guidelines. They are always active and ensure the agent respects the project’s ecosystem as a whole.
The Skills, on the other hand, guarantee compliance on demand. Saved as Markdown in the .agents/skills/ directory, they operate by progressive disclosure, making the context only be injected if the developer’s task matches the Skill description.
This is an example of governance in source code using a Skill, where the AI is only instructed to do the security audit if the developer is specifically messing with databases or authentication:
---
name: foocorp-security-audit
description: Review code changes for corporate security vulnerabilities. Use when implementing authentication or database queries.
---
# Corporate Security Audit Guidelines
## Review Checklist
1. **SQL Injection Prevention**: All database queries must strictly use parameterized statements. Using string formatting or concatenation to build queries is strictly prohibited.
2. **Authentication**: Verify that the application correctly integrates with the corporate IAM (Identity and Access Management) for all authentication flows.
3. **Logging**: Ensure that no Personally Identifiable Information (PII) is ever printed or saved in the application logs.
## Execution Rules
- Always generate a walkthrough artifact summarizing the changes and the results of the security audit.
- **HALT EXECUTION**: If a security vulnerability is found during the review, you must halt the execution and request human approval before applying any fixes or proceeding with the task.(To visualize how this architecture works in practice, the diagram below illustrates the exact chronology of the shared state flow and the tool calling via MCP):
The Art of Directing, Not Just Typing
The trinity Gemini Enterprise, Antigravity, and ADK ends the AI testing phase in development and initiates the Invisible Platform. The heavy infrastructure now runs on autopilot in the background, the toil disappears from your sprint, and engineering finally gains mental space to focus on true innovation.
Instead of wasting hours configuring environments or fighting against a code’s syntax, the role of engineering becomes much more managerial; professionals design the business vision and structure the agents’ rules, when the machine proposes a change, they assume the role of auditors in Plan Mode and, after validation, carry out the deploy of the robots.
Engineering went back to being about solving complex problems and creating architectures that work. And the best of all is that now you can drink your coffee while it’s still hot.
Five concepts for you to master this week and accelerate your transition to the AI SDLC:
- Shift-Left at the Source: Antigravity becomes your private security guard with total context of the repository. You kill the vulnerability long before the idea of running a git commit crosses your mind.
- Workflow Agents against the “LLM Roulette”: Stop hoping the AI guesses the flow. The rule now is to use deterministic engines like the ADK. You tie sub-agents into logical pipelines and take luck out of the equation.
- Zero-Trust AI: Never hand over raw sensitive data to the AI, demand tokenization via Cloud DLP and put an end to hallucinations by forcing Grounding straight into the company’s official documentations.
- GitOps as Gatekeepers: You audit all the impact in Plan Mode before releasing any execution; the human in control is non-negotiable.
- The “USB-C” of AI (MCP): The manual labor of custom integrations is over. The Model Context Protocol (MCP) is the universal adapter that connects agents to external tools with absolute security.
If this transition seems challenging at first, it’s worth remembering that no one needs to face this new scenario alone. Tools like Gemini itself are always available to support everyone from the developer with doubts in the terminal, to the infrastructure operations engineer and the leadership that orchestrates the strategy throughout this learning curve.
“Gemini, help me take the first step with the Model Context Protocol. How do I create an MCP Server on my machine so my agent can read a local file safely?”
But, far beyond technology, the greatest support network resides in the Googler community. There are professionals propelling the ecosystem, diving deep into studies, and working hard to ensure that all these AI practices are implemented in a responsible, secure, and humanized way. Technology orchestrates, but it’s people who give the direction.
P.S.: Although the theme celebrates automation and the power of Artificial Intelligence, this text was written with a lot of reflection, coffee breaks, and without the use of AI.
