September 2026 Summaries

Video diffusion inference is slowed by many denoising steps and especially by quadratic self-attention costs at long video sequence lengths, making attention an increasingly dominant bottleneck as resolution rises. The Sparse VideoGen approach exploits the structured behavior of attention heads, dynamically routing them to spatial or temporal sparse masks that preserve important interactions, including first-frame context, while eliminating many low-value query-key pairs. On TPU hardware, however, logical sparsity alone initially performed worse than dense attention because elementwise masking within visited compute tiles imposed substantial overhead; performance improved by separating fully valid tiles from boundary tiles, tuning tile sizes, and slightly aligning mask boundaries to hardware tiles. These kernel changes reduced single-device sparse attention latency from 78.70 ms for dense attention to 32.76 ms, a 2.40× speedup. Efficient integration also required static tensor shapes for dynamic head routing, temporal token permutation to make temporal access contiguous, and applying layout changes after distributed head exchanges to avoid excess communication. In end-to-end generation on eight TPU v6e chips, aggressive sparsity reduced 720p denoising time by 22% to 119.86 seconds, while larger resolutions yielded greater gains: 1.49× at 1080p and 1.69× at 1440p, saving more than 16 minutes per video while maintaining comparable output similarity.

Google Cloud API Gateway now supports acting as a remote Model Context Protocol server in Public Preview, allowing teams to expose existing REST API operations as agent-callable tools without building and maintaining separate MCP infrastructure. By annotating OpenAPI 3.0 or 3.1 specifications, developers can let the gateway translate MCP JSON-RPC tool calls into REST requests while preserving existing authentication, quotas, logging, and policy enforcement. API Gateway serves MCP through a `/mcp` endpoint, supports tool discovery and invocation by MCP-compatible clients such as ADK and Gemini Enterprise, and can publish tools through API Hub and Agent Registry. Tool descriptions should explain when and why an agent should use an operation, while production deployments can protect tool discovery with JWT authentication and continue enforcing each REST operation’s existing security requirements. The feature is positioned as a lightweight option for services such as Cloud Run, alongside Apigee for broader enterprise API management and Agent Gateway for governing outbound agent calls. Current limitations include no support for OpenAPI 2.0, empty HTTP 204 responses, some deeply nested schemas, more than 1,000 tools per gateway, simultaneous use of MCP and model routing in one API configuration, and capabilities such as streaming, prompts, resources, and Model Armor inspection remaining on the roadmap.

Google’s MaxText team reproduced AI2’s open OLMo 3 7B language model on Cloud TPUs using JAX/XLA, matching both its large-scale stage-1 pretraining run of roughly 5.93 trillion tokens and its stage-2 mid-training anneal against AI2’s PyTorch/GPU references. They ported OLMo’s specialized architecture, converted initial checkpoints with close logit parity, and validated fidelity through held-out C4 loss, multi-domain perplexity, token-level KL, and an eight-task benchmark suite rather than relying only on training loss. This evaluation exposed a double-sharding data-loader bug that made training loss appear better through memorization while held-out performance remained unchanged, underscoring the importance of generalization metrics and exact checkpoint-resume testing. The project also demonstrated that the training recipe could survive preemptions, reproduce losses exactly after resume, scale efficiently between TPU slice sizes, and move from Ironwood to v5p TPUs without altering the core launcher. Performance optimizations achieved 44.5% model FLOPs utilization on Ironwood and 57.4% on v5p, while a separate attention-head reshaping experiment increased throughput by 12.4% at unchanged parameter count and FLOPs. The authors conclude that cross-framework reproductions can be faithful within run-to-run variation when data handling, optimizer precision, deterministic resumption, and held-out evaluation are rigorously controlled, with long-context adaptation and post-training work planned next.

Google announced local-workflow support in the Antigravity SDK, initially optimized for running Gemma 4 26B A4B through Google AI Edge’s LiteRT, enabling developers to use agentic capabilities offline on local GPUs and memory. The update is positioned as a way to reduce API costs and rate limits, preserve privacy for sensitive code, maintain operation without reliable internet access, and support hybrid workflows that combine local and cloud models. Google recommends machines with more than 24 GB of VRAM or unified memory and provides setup instructions for installing the SDK, LiteRT-LM, and the model, then creating agents that can inspect files or generate and test software locally. A hybrid Architect-Builder demonstration uses Gemini 3.8 Flash to plan work from filenames and task descriptions while local Gemma instances audit, patch, critique, and test vulnerable Python modules, with 97.2% of tokens reportedly processed locally and no source code sent to the cloud. The SDK also supports practical local utilities, such as an agent-generated terminal resource monitor, and can connect to OpenAI-compatible local servers including Ollama, LM Studio, and vLLM without changing agent orchestration or workflows.

Google AI subscribers are gaining premium Google Colab benefits, including priority access to faster accelerators and more powerful computing machines, with Google AI Ultra members also receiving uninterrupted background execution and Premium GPU access for long-running training jobs. Google positions its AI plans as a central subscription option combining enhanced Colab capabilities with expanded cloud storage, access to advanced Google models, Gemini app and Workspace features, and premium developer tools such as Google Antigravity and Google AI Studio. Existing Colab subscriptions will remain unchanged, while Google AI benefits can be combined with them for additional access. The new benefits will roll out over the coming weeks in countries where Colab is supported.

Google DeepMind and Speakeasy have open-sourced Speakeasy’s OpenAPI code-generation suite after collaborating to deliver Google GenAI SDKs for the Interactions, Agents, and Webhooks APIs. The move followed the abrupt shutdown of Google’s previous proprietary SDK-generation provider in May 2026, which underscored the risks of relying on closed tooling for rapidly evolving APIs. Speakeasy’s AGPLv3-licensed suite generates typed SDKs for Python, TypeScript, Go, Java, C#, PHP, and Ruby, including support for streaming, retries, and pagination, while also providing generators for agent-oriented CLI binaries and documentation-based MCP servers. Google integrated the deterministic generator with AI agents for custom SDK work, reducing maintenance of its multi-language client pipeline from several engineers to approximately one, and states that users retain their preferred licenses for generated code while modifications to the generator itself must remain open source.

Agent Anomaly Detection, currently in Private Preview for Gemini Enterprise Agent Platform users with ADK 1.2 or later, is an asynchronous oversight and audit capability designed to identify unsafe or unintended autonomous-agent behavior that conventional success metrics may miss. It analyzes existing reasoning traces, tool calls, logs, and OpenTelemetry data to flag suspicious intent, policy violations, and behavioral anomalies without adding latency to live requests, while publishing actionable findings with severity, explanations, and recommended remediation to Security Command Center. Its layered pipeline first identifies statistical outliers across traffic, then uses LLM-based reasoning to examine suspicious sessions in depth and, when necessary, reconstructs detailed tool activity; an inventory-agent example illustrates how repeated large-batch pagination could be recognized as systematic scraping and resource exhaustion despite producing no errors. The service includes detectors aligned with selected OWASP Top 10 for Agentic Applications risks, including tool misuse, privilege abuse, cascading failures, rogue agents, resource exhaustion, and token escalation, and it provides an API that can enable organizations to automatically halt or restrict future agent actions based on configured risk thresholds. Planned additions include natural-language and deterministic custom detectors that organizations can test against historical traffic.

Part 2 of the Zero-trust Agents series describes how managed runtime governance on the Gemini Enterprise Agent Platform complements deterministic build-time controls for a customer support and returns agent. It introduces Agent Gateway as an enforcement point for Model Armor, which blocks prompt injections and redacts sensitive response data; Semantic Governance Policies, which use natural-language business rules to evaluate tool calls based on user intent and context; and Agent Anomaly Detection, which analyzes session-level telemetry for suspicious patterns. Using an order containing both a physical accessory and a digital software license, the example shows how these controls block a jailbreak prompt, deny an unauthorized $120 software-license refund requiring manager approval, and detect an attacker splitting refunds into individually permitted $20 requests that collectively exceed the order value. When an anomaly is detected, administrators can add or automate a new runtime policy that prevents further refunds on the same order without changing, rebuilding, or redeploying agent code. The approach emphasizes defense in depth, retaining signed Cloud KMS transactions and sandboxing while adding adaptive controls that assess payloads, intent, and behavior over time.

Autofinetune is presented as an autonomous framework for LLM post-training that adapts the autoresearch approach to supervised fine-tuning and GRPO reinforcement learning using Tunix, Gemma models, Cloud TPUs, Antigravity CLI, and Gemini Flash 3.7. Rather than manually changing hyperparameters, launching jobs, evaluating results, and tracking experiments, users define constraints and success metrics in a Markdown file and provide a self-contained training script, enabling an agent to modify configurations, run experiments, preserve improvements through Git commits, revert regressions, and log outcomes. In an SFT case study, the system conducted 20 experiments over several hours to optimize FunctionGemma-270m-it for function-call generation on the Mobile Actions dataset, exploring settings such as LoRA configuration, optimizer, learning rate, schedules, batch size, and seeds while keeping the dataset, architecture, and epoch count fixed. A second case study applied the approach to GRPO training of Gemma 3 1B on GSM8K math reasoning, where 40 experiments over two to three days explored LoRA settings, rollout temperature, KL penalties, and prompts, improving a combined numerical and formatting accuracy metric by roughly 10 percent.

Google has released version 1.0 of the Agent Development Kit for Kotlin, a production-ready, Kotlin Multiplatform framework for creating AI agents across Kotlin, Java, server-side JVM, and Android applications. The release reaches feature parity with ADK’s Python and Java core offerings, adding multi-agent orchestration, context compaction, resumable sessions, human-in-the-loop confirmations, annotation-based tool generation, Java interoperability, and Vertex AI enterprise services. Kotlin Symbol Processing generates type-safe tool schemas at compile time without runtime reflection, while skills enable agents to dynamically load procedural playbooks and supporting resources through progressive disclosure. Examples show an incident-response agent that diagnoses database alerts using monitoring and deployment tools, and an Android financial assistant that uses Firebase AI, requires user approval for fund transfers, and persists sessions, memory, and artifacts through Room, AppSearch, and Android storage. ADK for Kotlin 1.0 also offers Android-focused options for private or offline on-device agents through LiteRT-LM and ML Kit, alongside hybrid cloud workflows via Firebase AI Logic.

Behavioral evaluations offer a granular complement to end-to-end benchmarks for agentic coding systems by testing observable intermediate actions, such as asking clarifying questions, running validators, or using live search, rather than relying only on composite task-success scores. While broad benchmarks can reveal whether performance changed, behavioral tests help identify why it changed and provide fast, deterministic safeguards against regressions caused by prompt, tool-schema, or model updates. The approach is most useful after an agent has matured enough for routine dogfooding, with evaluation suites focused on maintaining reliable forward progress rather than celebrating small score improvements. Effective suites begin with specific recent failure modes, use strict assertions for simple tasks and flexible outcome-based judgments for complex ones, and track aggregate results from batch runs to account for model nondeterminism. Behavioral evaluations do not replace macro benchmarks; together, they support both verification of overall outcomes and safer, faster iteration on agent harnesses.

Google Cloud’s Gemini Enterprise developer experience program tests its AI platform through repeatable developer workflows using no internal shortcuts, documenting friction and working with engineering to resolve issues quickly. In a governance-focused sprint, the program evaluated the end-to-end process of provisioning agent identities, registering agents, routing traffic through Agent Gateway, applying access and content-safety policies, and verifying that permitted and blocked actions are enforced and auditable. Improvements included clearer requirements for Identity-Aware Proxy, secure-by-default Model Armor examples, gateway configurations that preserve essential platform calls, networking guidance for Semantic Governance, corrected IAM policy syntax, explanations of policy evaluation timing, and ready-made monitoring queries. Google Cloud says it will continue validating fixes through real user journeys and iterating to make Gemini Enterprise agent governance more secure, reliable, compliant, and easier for developers to use.

A review of leading submissions to the Google for Startups AI Agents Challenge identified four engineering patterns that distinguished robust multi-agent systems from simple prompt chains. These patterns include bidirectional Model Context Protocol (MCP) design, where agents use bounded internal tools and can expose their capabilities as secure MCP servers for other agents; event-driven concurrency, where independent agents react to shared typed events in parallel rather than waiting through sequential calls; fallback model architectures that enforce identical validation standards for primary and backup models; and tiered routing that handles simple requests with deterministic rules or inexpensive classifiers before invoking costly reasoning models. The examples showed how these approaches can reduce context size, latency, inference costs, and reliability risks while making agent capabilities more reusable. Although these patterns appeared frequently in projects using Google’s Agent Development Kit and Agents CLI, they are presented as broadly applicable engineering practices that can be combined to create more scalable, resilient, and genuinely collaborative agent systems.