# Google Cloud’s New Agent Compute Engine: What You Need to Know
Google Cloud has introduced a specialized compute service designed from the ground up for AI agents. The service, called Agent Compute Engine, assigns each AI agent its own isolated microVM — a lightweight virtual machine that runs entirely on its own. Google says the platform is already being used internally to power Gemini as an agent for real work tasks, and it was announced at the company’s recent AGNTCon + MCPCon event.
The core promise is straightforward: give every AI agent its own secure, hardware-isolated environment without sacrificing the speed and efficiency that modern applications demand.
—
## How Does It Work?
Every AI agent running on this platform is split into two distinct parts. The first part, sometimes called the “brain,” handles communication with the AI model itself — deciding what to do next, planning tool calls, and orchestrating the overall task. The second part, sometimes called the “hands,” actually executes code, runs shell commands, and launches browsers inside the sandbox.
The brain runs completely outside the sandbox and only sends explicit, controlled commands into it. This separation means the model never directly touches the execution environment, which reduces risk significantly.
Each agent session runs inside a single-tenant microVM powered by Google’s Cloud Hypervisor. The host machines themselves are stateless appliances with a read-only root filesystem and hardware-backed attestation through Titan silicon. This means even if something goes wrong inside the agent’s environment, the underlying host remains untouched and can be reset instantly.
—
## Zero Credentials, Zero Trust
One of the most interesting design choices is how networking is handled. The microVMs have no standard network interface, no default gateway, and no direct access to Google’s VPC network. All traffic passes through a virtual socket to a local proxy, which then forwards it to an external gateway.
Every agent session receives only a short-lived identity certificate and a temporary token. A specialized gateway on the host side translates this into the real backend credentials needed to reach external services — but only after verifying the user’s identity, the agent’s authorization, and any relevant security policies. The sandbox itself never sees or stores any real credentials.
Google’s assumption is that an attacker could fully control everything inside the sandbox. Under that assumption, there is nothing valuable to steal, making the entire system much harder to exploit.
—
## Four Separate Identities
Google defines four distinct identities for every agent workload, each serving a different purpose:
1. **User identity** — confirms who the actual human is that started the task. Used only for authentication, never for agent operations.
2. **Delegated on-behalf-of identity** — a scoped grant that proves the user authorized the agent to act. This lives in a central authorization service and is never stored on the compute node.
3. **Agent Workload Identity** — a short-lived SPIFFE identity that represents the sandbox itself. This is the only identity used for network traffic within the sandbox, and it tells the system which specific sandbox sent a given packet. If someone exfiltrates it, it is useless for making direct API calls.
4. **Agent Workforce Identity** — represents the agent as its own entity with its own account and resources, allowing it to act independently as an assistant.
This layered approach ensures that no single leaked credential can grant broad access to systems.
—
## Keeping Idle Agents Inexpensive
AI agents spend most of their time waiting — either for a model response or for user input. To avoid paying for idle compute, the system checkpoints sleeping microVMs to zero active resources. When the agent is needed again, it resumes from a snapshot almost instantly.
Google achieves impressive density through copy-on-write memory sharing. Multiple microVMs on the same host share a single base image of the operating system and libraries in memory. Only the pages that each agent actually modifies consume private memory. This allows many agents to run on a single host without duplicating large amounts of data.
Storage is also divided efficiently: disposable scratch space for temporary work, shared read-only volumes for common files, and persistent Hyperdisk volumes for user workspaces that need to survive between sessions.
—
## The Open-Source Companion: Agent Substrate
For teams that want to run this infrastructure themselves, Google offers Agent Substrate, the open-source counterpart that runs on any Kubernetes cluster. It has been available on Google Kubernetes Engine since mid-September 2026 and supports Cloud Hypervisor microVMs as well as gVisor sandboxes.
In benchmarks, Agent Substrate handled over 200,000 concurrent agents with 500 activations per second and resume times under 500 milliseconds. It also demonstrated up to 1,000 dormant agents per host, making it highly efficient for workloads with many idle agents.
The open-source version works with popular harnesses like Claude Code, OpenClaw, and Hermes. Non-production use is freely available, while production access requires an allowlist.
—
## How It Compares to the Competition
Several other companies offer agent sandboxing services. AWS provides AgentCore Runtime with dedicated microVMs and identity-managed credentials. Microsoft offers dynamic sessions on Azure using Hyper-V sandboxing. Independent platforms like E2B provide Firecracker-based microVMs with snapshot capabilities.
Google’s approach stands out by combining hardware-level isolation with zero internal credentials and aggressive idle resource reclamation. The trade-off is that pricing details, boot times, and a public launch date for Agent Compute Engine have not yet been announced. Agent Substrate offers more transparency on performance but requires Kubernetes expertise to deploy.
—
## Looking Ahead
Beyond the compute layer, Google is building a broader governance stack for AI agents. This includes a dedicated gateway for enforcing policies, a registry for tracking agent deployments, identity management, and observability through OpenTelemetry. New capabilities are rolling out in stages, with support for multi-cloud enforcement, local coding agent governance, token management, and delegated authorization with third-party identity providers like Ping Identity, SailPoint, and Saviynt all expected soon.
—
## Frequently Asked Questions
**Q: What exactly is a microVM?**
A microVM is a lightweight virtual machine that includes its own guest kernel and minimal operating system. Unlike full virtual machines, microVMs boot quickly and use very little memory, making them ideal for running many instances in parallel on a single physical host.
**Q: Why does the sandbox have no network interface?**
By removing standard network access, Google forces all agent traffic through a controlled proxy and gateway. This means no agent can accidentally or maliciously connect directly to internal services. Every request is inspected and rewritten before it leaves the host.
**Q: Can an agent steal credentials from the sandbox?**
No. The sandbox contains no credentials, API keys, or tokens. Even if an agent is compromised through a prompt injection attack, it finds nothing useful to exfiltrate.
**Q: Is Agent Compute Engine available now?**
No. Customer preview is targeted for the coming months. Pricing, boot times, and a full launch date have not been publicly disclosed.
**Q: What is Agent Substrate and who can use it?**
Agent Substrate is the open-source version of the same microVM isolation technology, designed to run on Kubernetes clusters. It is available for non-production use by all GKE customers and for production use through an allowlist program.
**Q: How does idle agent handling save money?**
Instead of keeping a full virtual machine running and consuming resources while the agent waits, the system freezes the agent’s state and releases all CPU and memory. The agent resumes from a snapshot when needed, paying only for active compute time.
**Q: How does Google compare to AWS AgentCore or E2B?**
Google offers stronger internal credential isolation (zero credentials in the sandbox) and more aggressive idle resource reclamation. AWS and E2B are currently available for general use, while Google’s service is still in preview. Google’s open-source Agent Substrate provides a middle ground for teams that want self-managed deployment.
—
## Conclusion
Google Cloud’s Agent Compute Engine represents a significant step forward in how AI agents are run in production. By combining hardware-isolated microVMs, zero internal credentials, and aggressive idle resource management, it addresses many of the security and cost concerns that have slowed enterprise adoption of agent-based systems. The open-source Agent Substrate companion ensures that these capabilities are accessible beyond Google Cloud’s native ecosystem.
While several details — including pricing, boot times, and a firm launch date — remain undisclosed, the technical architecture signals Google’s intent to make agent infrastructure both secure and efficient at scale. As the agent ecosystem matures, services like this will likely become a foundational layer for any organization deploying AI agents in production environments.
Thank you for reading
