Google Unveils Agent Compute Engine for AI Agents

Google Cloud has unveiled Agent Compute Engine, a service that gives each AI agent its own hardware-isolated virtual machine, and says it already runs the company’s Gemini agent for work. Customers will be able to use it “in preview in the coming months”, Google said in an announcement on Thursday at the AGNTCon + MCPCon conference. It gave no date for general availability and no pricing.

Alongside it, Google released Agent Substrate, an open-source runtime that brings the same design to Kubernetes clusters, and widened its agent governance tools to cover agents running on other clouds and on employees’ laptops. The pitch is that agents, which constantly start, stop and run untrusted code, need a different kind of computer from ordinary cloud workloads.

Each agent gets its own microVM with no secrets inside

Google says it built Agent Compute Engine because “traditional compute primitives are not built for running hundreds of millions of these agents at planet scale”, according to a technical deep dive published the same day. It splits each agent into a harness, the “brain” that calls the model, and a sandbox, the “hands” that run code, shell commands and a browser.

Each sandbox is a microVM behind “a hardware-isolated Cloud Hypervisor boundary with its own guest kernel and root access”, running on Titanium, Google’s own infrastructure processing unit. To keep costs down, Google says it uses copy-on-write memory sharing to run many agents from one operating system template, and pauses idle microVMs through checkpoint and restore while an agent waits for the model or a person. Each microVM has its own Hyperdisk volume so work persists across sessions.

The security design starts from one rule, the deep dive says: “Assume an attacker controls everything inside the sandbox, and make sure they find nothing there to use.” A microVM never holds user credentials, API keys or OAuth refresh tokens, and sandboxes “boot without a standard external network card”, with all traffic passing through an external proxy that injects credentials only after checking policy. Google’s example is an email carrying hidden instructions to find API keys and send them away; the sandbox, it says, has none to find.

“Agent Compute Engine microVMs give us the responsiveness, hardware isolation, and workload density needed to deliver interactive agent sandboxes to our users around the world,” said Gautham Thambidorai, a vice-president and Google Fellow on Gemini. The service already sits under the Gemini agent Google Cloud announced this month.

Agent Substrate brings the design to Kubernetes

For teams that run their own Kubernetes clusters, Agent Substrate on Google Kubernetes Engine snapshots an idle agent’s memory, hands the machine back to the pool and resumes the agent when needed. Google says it delivers “as much as 10x higher compute density compared to traditional compute”, and that “in benchmark validation running 200,000 agents, Agent Substrate sustained 500 activations per second at less than 500 ms suspend and resume latency”. Those are Google’s own figures from its own tests.

Isolation comes from a choice of microVM or gVisor, and Google says the runtime works on any Kubernetes cluster and with agent harnesses “including Claude Code, OpenClaw, and Hermes”. Nous Research, which makes Hermes, is already using it, according to its chief business officer, Hervé Bizira.

On governance, Google is extending its Agent Gateway, Agent Registry and Agent Identity tools across its own runtimes, to other clouds through Envoy-based enforcement points, and to coding agents such as Claude Code and Antigravity CLI on managed devices. Both extensions are “in preview soon”. Token and cost controls and model routing are due “this quarter in preview”.

Google is selling the sandbox it built for itself

Agent Compute Engine turns agent sandboxing into a Google Cloud product, and Google is not alone in the space. Rival approaches have appeared in quick succession: Perplexity has open-sourced SPACE, its Firecracker-based sandbox, and NVIDIA has launched its OpenShell reference architecture for containing agents in software and silicon. Google’s argument is scale and hardware: a design already tested on its own consumer and enterprise agents, anchored in its Titan and Titanium chips.

The credential design is the most concrete part of the pitch. Keeping secrets entirely outside the sandbox addresses the prompt-injection case Google describes, where a model obeys hidden instructions it should ignore, without relying on the model to behave.

But customers cannot test any of this yet. Agent Compute Engine is not in preview, the cross-cloud and endpoint governance features are “in preview soon”, and the density and activation figures have not been checked by anyone outside Google. Agent Substrate is the exception: Google says developers can try it on GKE today. Its compute news this week also includes A5X instances on NVIDIA’s Vera Rubin, due next month; for Agent Compute Engine, Google has offered only an interest form.