Antigravity Meets Claude Code: Two Agent Desktops, One Threat Model

By Muhammad Kashif · Draft · AI automation & cybersecurity builder, Pakistan

Antigravity-shaped agent desktops and Claude Code on the same week invited a bad idea: two all-powerful agent environments, one vague trust boundary. Gemini 3 Pro pitching interactive experiences, generative UI in Search, Claude visual builders, Cowork built in ten days with Claude Code — the capabilities are real. My threat model had to get louder than the demos.

Two desktops, one threat model

Antigravity-class apps promise parallel subagents for front end, back end, debugging, research. Claude Code promises long agentic sessions with skills and repo memory. Running both with write access to the same secrets is how you get divergent "fixes" and a production outage with two confident logs.

I pick a primary desktop per repo. The other may read. Only one may write. The threat model document says so above the fold.

Generative UI is still UI under policy

Gemini building interactive tables and simulations inside Search AI Mode is impressive. Claude visual builders making charts on the fly are useful in workshops. Neither gets a free pass on accessibility, data exfiltration via rendered content, or "helpful" live data pulls from the wrong sheet.

Interactive does not mean unsupervised. I treat generated UI like generated code: review, sandbox, then expose.

Cowork in ten days as a warning

Claude Cowork built in ten days using Claude Code is a shipping story and a governance warning. Fast internal tools accumulate permissions while everyone is celebrating. I ask which scopes launched on day ten, and which were cleaned on day thirty.

If there is no day-thirty cleanup, the ten-day miracle is a thirty-day incident seed.

Custom agents and chained workflows

/agents building custom agents, @ referencing files, chaining research to hooks to scripts to titles — powerful composition. Composition without ownership is spaghetti that can send email. Each chain gets an owner, a log, and a kill switch.

Karpathy-style autonomous research stays in a research VPC-shaped folder. It does not get production deploy keys because the prose sounded scientific.

Subscriber growth is not my control plane

Gemini and Claude paid growth, Macrohard jokes, executive returns — noise. My control plane is IAM, evals, and whether two agent desktops can collide. I will not redesign security because a launch video had good music.

Pitch decks beating Gamma on design quality are interesting for sales enablement. They are irrelevant to whether Antigravity and Claude Code share a .env.

Parallel subagents under a budget

Google showing dozens of subagents building something huge is a demo. My pilots start at three specialists, a shared plan, and a token budget. Scale after the merge protocol is boring.

Ninety-three subagents without a human integrator is not ambition. It is a distributed mess with cloud spend.

Shared rules file

AGENTS.md and a threat model that both desktops must read. Same classification labels. Same forbidden actions. Same review cadence. If a desktop cannot ingest the rules, it does not get the repo.

Compatibility with the rulebook is a procurement requirement, not a nice-to-have.

Pilot offer

One primary agent desktop, one read-only secondary, three connectors, weekly collision review. Expand writers only after two clean weeks. That is the whole deal. Everything else is a demo day.

Collision log

Whenever Antigravity-shaped tools and Claude Code touch the same paths, I append a collision log line: who wrote, who overwrote, what tests said. Patterns in the log tell me if dual desktops are worth it. Empty collision logs for two weeks earn a small scope expansion. Noisy logs earn a primary-desktop mandate.

Day-thirty cleanup ticket

Every fast Cowork-style internal tool gets a calendar ticket thirty days out: review scopes, delete unused connectors, confirm owners. Ten-day miracles without day-thirty cleanup are how Antigravity and Claude Code collide with stale secrets.

Primary writer lock

Git branch protection plus a chat announcement: only the primary desktop may push this week. Antigravity can propose patches as files; Claude Code applies if it is primary, or the reverse. Locks prevent polite collisions.

Generative UI review hour

Interactive charts and Search-mode simulations get the same review hour as code PRs: accessibility glance, data source check, exfiltration skim. Gemini and Claude visual builders do not skip the queue because they look like slides. Antigravity desktops host the review notes beside the threat model.