Google Cloud launches Agent Compute Engine, a microVM for every AI agent

What Google announced

Google Cloud announced Agent Compute Engine on 22 October 2026 at AGNTCon + MCPCon, the Linux Foundation agent conference in San Jose. It is a compute service that gives every AI agent its own hardware-isolated micro virtual machine, a small VM that starts much faster than a conventional one. Google says the same system already runs Gemini when it acts as an agent for work tasks.

Customers cannot use it yet. Google says Agent Compute Engine is targeted for preview in the coming months and has opened an interest form. Alongside it, the company released Agent Substrate, an open-source runtime that brings a similar design to Kubernetes, and expanded the agent governance tools in Gemini for business.

AGNTCon + MCPCon is a Linux Foundation event, and the Linux Foundation's Agentic AI Foundation this week took in four more agent projects from OpenAI, Anthropic, Hugging Face and Alibaba, so infrastructure for running agents safely was a theme of the day.

Why agents need their own computers

A companion technical deep dive explains the problem Google set out to solve. The Gemini team wanted every user to have a personal agent that runs in the cloud, remembers their work and acts while they are away. The Gemini for business team wanted company agents that read Workspace documents and query private databases. Both split an agent into a harness, the brain that calls the model, and a sandbox, the hands that run code, shell commands and a browser.

Google argues that neither standard option fits those hands. Traditional VMs offer strong isolation but take seconds to minutes to start, suspend or resume, and agents do that constantly. Containers are fast and light but share the host kernel, while coding agents and developer assistants need full isolation and root-level control. Agent Compute Engine is Google's attempt to get VM isolation at container speed and density.

Google says the platform runs four kinds of work internally: interactive consumer and enterprise agents, long-lived software engineering workspaces, large evaluation and reinforcement learning pipelines, and sandbox backends for other Google services. Clement Farabet, a Google DeepMind vice president, is quoted saying it gives the Antigravity coding agent snapshot-and-fork primitives and fast resume.

How idle agents cost almost nothing

The central efficiency idea is that agents spend most of their time waiting, on the model, on a tool or on a person. Because Google built the sandbox command runtime together with the host, the host knows when an agent has finished a tool call and moved into its thinking phase with nothing running. At that point it checkpoints the microVM and moves it to an idle state where, Google says, it consumes no active resources, then restores it quickly on the next tool call.

The second idea is memory sharing. Hundreds of agents on one host run the same base image, Python runtime and browser. Agent Compute Engine builds pre-warmed snapshot images and maps them into physical memory using Direct Access and copy-on-write clones, so every microVM shares the same physical pages for the operating system and libraries, and only the pages an agent changes take new memory. Google also describes cloning, forking, rewind and rollback features, so an evaluation pipeline can snapshot one environment and fork thousands of copies.

Google adds a scheduling layer on top. It found that consumer Gemini agents peak in mornings and evenings, business agents peak during office hours in each time zone, and evaluation and RL jobs have no peak at all. Running all three on one pool, and pushing non-urgent work such as daily digests into quieter hours, lets it serve more agents on the same hardware. Google does not give figures for how much this saves.

The security design

Security gets the most detail, because an agent sandbox has to assume the code inside it may be hostile, for example after a prompt injection. Each agent session runs in a dedicated, single-tenant, memory-safe microVM on Cloud Hypervisor, an open-source virtual machine monitor, with its own guest kernel and root access. Hosts are stateless appliances with a read-only root filesystem, and Google's Titan chip and Titanium infrastructure processing unit verify hardware and firmware at boot and hold attestation keys outside the guest.

Google describes a zero-secrets design. The guest holds no persistent secrets, refresh tokens or service account keys and cannot reach the cloud metadata server. Each microVM gets only a short-lived, session-scoped SPIFFE certificate and identity token. When the agent needs a real credential, for instance to open a Drive file, Google's Agent Gateway checks the session's identity and policy and injects the credential outside the sandbox.

Networking is equally restricted. The microVMs have no standard network interface or default gateway. All traffic passes through a vsock channel to a local proxy and then an external gateway that enforces policy. Traffic is encrypted in transit, and memory snapshots and disks are encrypted at rest.

The idea of keeping credentials out of reach of the agent is spreading. AI Lookout covered Red Hat's OpenShell agent sandbox for OpenShift earlier today, which takes a similar line on isolating what an agent can touch.

Storage that survives between sessions

Agents become more useful when they remember. Google's example is an agent that installs two Python libraries and writes a script on Monday, then is asked a follow-up on Tuesday. If it has to rebuild everything, the user waits and may get a different answer. Each Agent Compute Engine microVM therefore gets its own Hyperdisk for persistent workspaces.

Google says giving every agent a standard disk would have exhausted storage and disk attachment slots, so it splits what agents write into three kinds: disposable scratch data in fast overlays, shared read-only volumes for base images and package caches, and the user's real working state, which is the only part kept durably.

Agent Substrate, the open-source version

For teams that prefer Kubernetes or need to run in other clouds, Google released Agent Substrate on Google Kubernetes Engine as open source. It snapshots an idle agent's memory, returns the machine to the pool and resumes the agent when needed. Google claims up to 10 times higher compute density than traditional compute with full kernel isolation, and says that in a benchmark with 200,000 agents it sustained 500 activations per second with suspend and resume latency under 500 milliseconds. These are Google's own figures.

Agent Substrate can isolate each sandbox with a microVM or gVisor, and Google says it works with any agent framework, naming Claude Code, OpenClaw and Hermes. Nous Research, which raised money for its Hermes business agents this month, is quoted as an early user for Hermes Enterprise.

Wider agent governance

The governance half of the announcement extends Agent Gateway, Agent Registry, Agent Identity and OpenTelemetry-based agent observability across more places agents run: Agent Runtime, Cloud Run, GKE, Agent Compute Engine in preview, other clouds through Envoy-based enforcement points, and managed laptops running coding agents such as Claude Code and Antigravity CLI. Google also lists token and cost budgets, model routing policies, Service Extensions and identity integrations with Ping Identity, SailPoint and Saviynt as coming to preview this quarter.

How it compares with existing sandboxes

Agent sandboxes are not new. The New Stack points out that E2B runs each sandbox in a Firecracker microVM that can pause and resume in about a second, that Daytona added microVM sandboxes in July, and that AWS Bedrock AgentCore gives each agent session its own microVM. Google itself already offers a managed Agent Sandbox on GKE and code-execution sandboxes in its agent platform.

Smaller players are pushing the same idea, from Perplexity's open-source Firecracker sandbox to Modal's plans for agent sandboxes on NVIDIA Vera CPUs. What Google is selling is the system it says it already runs at Gemini scale, with idle-aware checkpointing, shared memory pages and its own security silicon built in.

What is not known yet

Google has not published pricing, preview dates, regions, start-up latency figures for Agent Compute Engine or limits on session length. The density and latency numbers it gives are for Agent Substrate and come from its own benchmark. Whether customers pay nothing for idle agents, as the deep dive implies, will depend on billing terms that have not been released.

Watch for the preview launch and its pricing, for independent tests of escape resistance, and for whether the third-party models now on Google Cloud, including OpenAI's models and Codex, can run their agents on the same sandboxes.