Android Studio Now Runs Any Coding Agent: Inside Bring Your Own Agent and ACP

On September 24, 2026 the Android team shipped Bring Your Own Agent (BYOA) in Android Studio Canary. Last year Android Studio opened itself up to any AI model; this step hands the choice to the coding agent itself. Claude Agent, Codex, and Antigravity can now be wired directly into the IDE, with the IDE responsible for feeding them context and injecting its native tools. Here is what ACP actually does, why the project graph makes agents cheaper and sharper, and which governance gates you now need once the agent is a pluggable part rather than a bundled one.

1. What Actually Shipped

BYOA arrives in preview with the Rabbit 2 canary release of Android Studio and supports three of the agents developers already use daily: Anthropic's Claude Agent, OpenAI's Codex, and Google's Antigravity. You connect by signing in with your own plan or by providing an API key; the registry lives under Settings > Tools > AI > Agents, and any ACP-compliant agent can be added. Google lists four benefits: the full project graph, build setup, and platform details are handed to the agent over the protocol for token efficiency; you move seamlessly between conversational prompts and the IDE's purpose-built tools; agents are interchangeable when one runs out of quota or underperforms; and the IDE injects build diagnostics, Jetpack Compose Previews, Android SDK tools, and emulator control. In other words, the IDE stopped being a place with an AI inside it and became a host for an AI you choose.

// BYOA is a registry, not a hard-coded menu. Give Android Studio the
// command, the transport, and the identity of an ACP-compliant agent,
// and it shows up in the agent window like any other tool.

// Settings > Tools > AI > Agents  (name: claude, codex, antigravity, ...)
{
  "agents": [
    {
      "id": "claude",
      "label": "Claude Agent",
      "transport": "stdio",
      "command": "claude-agent --acp",
      "auth": "user-plan",
      "trust": "workspace-write",
      "pinVersion": ">=2,<3"
    },
    {
      "id": "antigravity",
      "label": "Google Antigravity",
      "transport": "stdio",
      "command": "antigravity --acp",
      "auth": "google-account-or-api-key",
      "trust": "workspace-write"
    }
  ]
}

BYOA lands in preview in Android Studio Canary

2. ACP Is the Layer That Matters

The headline is which agents are supported; the architectural decision is the Agent Client Protocol. It standardises how an agent and an editor talk: after an initialize handshake everything is a normal request and response stream, and the agent can ask to read a file, run a Gradle task, then read the build diagnostics it produced. Code sample 1 shows what that means in practice. BYOA is a registry, not a hard-coded menu: you declare the command, the transport, the identity, and a pinned version range instead of writing adapter code per vendor. Code sample 2 turns permission into an explicit capability declaration, where file writes, terminal access, and native tool injection are named entries on a reviewable list rather than a boolean. The value of a protocol is exactly this: swapping agents should not mean swapping your workflow, and it certainly should not mean swapping your security model.

// The interesting half of ACP is not "can I chat with a model", it is
// "what may this agent touch". Declare capabilities explicitly, then let
// the IDE decide what to inject. Native tool injection is a privilege,
// so keep it a named list rather than a boolean.

{
  "protocolVersion": "1",
  "clientCapabilities": {
    "fs": { "readTextFile": true, "writeTextFile": false },
    "terminal": false,
    "toolInjection": ["buildDiagnostics", "composePreviews", "emulatorControl"],
    "projectGraph": { "provide": true, "scope": "relevantOnly" }
  },
  "limits": {
    "maxTurnsPerTask": 25,
    "maxTokensPerSession": 400000
  }
}

3. Why the Project Graph Makes Agents Cheaper

Context is the most expensive resource a coding agent consumes. Android Studio's approach is to provide the full project graph, build setup, and platform details, then let the agent filter to the files that matter. Google describes the result as efficient token usage, lower latency, and sharper answers. That matches what teams keep rediscovering: rather than pushing an entire repository into the window, give the model a structured project view it can prune on demand. Code sample 3 expresses this in the initialize call, passing the project root alongside a fingerprint of the graph so the agent navigates by structure instead of guessing at filenames. The fingerprint has a useful side effect: it makes which revision the agent saw a recorded fact, which is exactly what you need when you are debugging why it edited the wrong file.

// A session opens with an initialize handshake. Everything after it is a
// normal request/response stream, which is why the same agent binary can
// sit behind a CLI, a CI runner, or an IDE without a rewrite.

const session = await client.initialize({
  clientName: "android-studio",
  protocolVersion: "1",
  workspace: { root: projectRoot, graphFingerprint: "sha256:9f2c..." }
});

// One prompt, and the agent can ask for a file, run a Gradle task,
// then read the build diagnostics we already declared it may receive.
const turn = await session.prompt({
  role: "user",
  content: "Migrate this screen to Compose and make the tests pass."
});

for await (const update of turn.stream) {
  if (update.kind === "tool_call" && requiresApproval(update.name)) {
    await session.requestPermission(update);
  }
}

ACP is the contract between the agent and the IDE

4. Native Tool Injection and Permissions

The real leverage of BYOA is native tool injection: build diagnostics, Compose Previews, the Android SDK tools, and emulator control. The agent is no longer just writing code, it is executing, diagnosing, and verifying inside your environment. Google pairs this with granular permissions, where routine work proceeds autonomously and riskier actions pause for approval. The loop in code sample 3 shows the shape of it: when a streamed tool call needs consent, ask before continuing. That follows a principle teams learn the hard way, which is that the control point belongs on the action rather than on the agent's stated intent. An agent pursuing an objective will happily describe a destructive write as routine refactoring, and only an environment-level gate will catch it.

// The convenience of pluggable agents is also the risk: every new agent
// is new code with new credentials inside your build environment. Pin
// what is allowed, and fail the build when someone adds a rogue one.

const ALLOWED = new Map([
  ["claude",       { min: "2.0.0", egress: ["api.anthropic.com"] }],
  ["codex",        { min: "1.4.0", egress: ["api.openai.com"] }],
  ["antigravity",  { min: "3.0.0", egress: ["*.googleapis.com"] }],
]);

export function auditAgents(config) {
  const problems = [];
  for (const a of config.agents) {
    const rule = ALLOWED.get(a.id);
    if (!rule) problems.push("unapproved agent: " + a.id);
    else if (!satisfies(a.pinVersion, rule.min)) problems.push("too old: " + a.id);
    else if (a.egress.some((h) => !rule.egress.includes(h)))
      problems.push("egress outside allowlist: " + a.id);
  }
  return problems;
}

5. The New Risk of Interchangeability

Being able to rotate Claude, Codex, and Antigravity through the same IDE on the same afternoon is genuinely convenient, and genuinely risky. Every new agent is new code running inside your build environment, with its own credentials, its own egress destinations, and its own release cadence. Code sample 4 turns that into a CI check: which agents are permitted, what the minimum version is, which hosts each one may reach, and a failing build when someone adds one that is not on the list. This is not distrust of any particular vendor; it is an honest response to what pluggability means. Google notes that both enterprise and consumer plans are supported, subject to the agent provider, and the flip side of that sentence is that credentials and compliance boundaries are yours to own, not the IDE's.

# What did the IDE agent actually do yesterday? If you cannot answer that
# from logs you own, "the agent edited my project" is a rumour, not a record.
# Log the turn, the tool, the files touched, and the diff hash.

def record(turn, tool, files, diff_hash, actor):
    ledger.append({
        "ts": time.time(),
        "agent": actor["id"],
        "version": actor["version"],
        "turn": turn,
        "tool": tool,                  # e.g. writeTextFile, gradle, emulatorControl
        "files": files,                # workspace-relative paths only
        "diffHash": diff_hash,         # reproduce the change, do not re-read it
        "approvedBy": actor.get("approver"),   # set only when a human gated it
    })

# One reviewable line, instead of a mystery commit at 2am.
for row in ledger.tail(20):
    print(row["agent"], row["tool"], ",".join(row["files"]), row["diffHash"][:12])

Swapping agents should not mean swapping workflows

6. A Rollout Checklist

First, pilot this on the canary channel and treat BYOA as a preview rather than a stable dependency. Second, centralise the registry so agents, versions, and identity sources are pinned in one place instead of varying per laptop. Third, make native tool injection an explicit, minimal list. Fourth, route high-risk tool calls through an approval gate that logs both the request and the approval. Fifth, record provenance per step: which agent, which version, which turn, which files, and the diff hash, as code sample 5 lays out. Sixth, bound the agent in the container rather than in its promises, as code sample 6 does. Do all of that and you keep the upside of BYOA while retaining an environment you can explain.