Google Agent Compute Engine: An isolated microVM for every AI agent
Google's Agent Compute Engine promises hardware-isolated microVMs and externally brokered credentials for AI agents. Gemini uses the platform internally, but customer preview is still pending.
Google Cloud announced Agent Compute Engine on October 22, 2026: a purpose-built agent runtime with hardware-isolated microVMs, short-lived identities and centrally governed network access. Google says it already powers Gemini workloads. External customer preview is targeted for the coming months; pricing and region availability are not published.
CLAIM-LEVEL EVIDENCE
What is sourced and what remains open
Primary sources, vendor claims and unanswered questions kept separate.
- Primary source
Google announced a dedicated agent runtime
Its launch material documents microVMs, checkpoint and resume, per-agent Hyperdisk, and policy integration.
Evidence: Primary document ↗
- Vendor claim
Isolation and no long-lived guest secrets
The technical deep dive describes Titanium-backed attestation, off-guest credential brokering and restricted proxy networking.
Evidence: Primary document ↗
- Primary source
Customer preview is still future
Google says Agent Compute Engine should enter preview in the coming months; it is not presented as generally available.
Evidence: Primary document ↗
- Open question
No public price, region matrix or independent audit
The announcement does not independently validate all isolation claims or publish commercial terms for customer deployments.
Evidence: Primary document ↗
Announcements are not independent effectiveness tests. Methodology →
Agent infrastructure: Technology, limits and analysis
An AI agent that edits files, executes code and opens websites needs a computer as well as a language model. The hard question is who controls that computer's permissions, connections and persistent state. On October 22, 2026, Google Cloud introduced Agent Compute Engine at AGNTCon and MCPCon as infrastructure specifically for this workload. Google says each agent session runs inside a dedicated, hardware-isolated microVM, rather than a generic shared execution container. This is a substantial architecture announcement, but not a claim that every customer can activate the product in their cloud account today.
According to Google's technical deep dive, the platform already runs parts of Gemini and related internal agent workloads. Its security model combines a separate guest kernel, Cloud Hypervisor isolation and Google Titanium infrastructure. Agents may use root privileges within their guest machines without being entrusted with long-lived cloud credentials. Short-lived, cryptographically attested workload identities instead authenticate the sandbox. An external gateway evaluates the relevant user delegation and agent policies, then inserts only the authorized backend credentials when an outgoing request is made.
That separation is significant because code execution by a model is not the same as approval to call a sensitive API. Google describes restricted networking through mediated proxy paths and a distinction between an agent's orchestration harness and its execution sandbox. The gateway can evaluate which agent is acting for which user, under which permissions, and record those decisions. Such a design can reduce the impact of untrusted code inside a sandbox. However, it cannot make an incorrect identity policy correct or replace independent verification of tenant boundaries and leakage scenarios.
Efficiency is the second motivation. Agents frequently wait for a model response, an external tool or human approval. Agent Compute Engine can checkpoint a waiting microVM, free active resources and resume the process later. Memory deduplication and copy-on-write cloning aim to make large agent fleets cheaper to host, while separate Hyperdisk storage preserves the working context. The mechanisms are described in useful engineering detail. Actual customer pricing, supported regions, general-availability commitments and independent benchmarks for this service have not been published.
Readers should also distinguish Agent Compute Engine from Agent Substrate, a separate Kubernetes-native runtime in the same announcement. Google reports performance figures for Agent Substrate, but those numbers are not measurements of Agent Compute Engine. Related Agent Registry, Gateway and Identity services are expanding their scope across cloud runtimes and eventually other environments. Enterprise teams need to confirm which feature is already available, which is in preview, and which is merely planned before writing procurement or architecture specifications.
Our editorial assessment is that combining stronger execution isolation with off-sandbox credential issuance addresses a real weak point in autonomous agent systems. It makes safety less dependent on the model always choosing the right action. Still, enterprise adoption should be conditional on region commitments, contractual details, actual tenant isolation tests, audit access, realistic failure cases and transparent operating costs. For now, Agent Compute Engine is a promising announced platform, not an independently validated universal solution for secure AI agents.
Original sources and further reading
- Google Cloud – Introducing Agent Compute Engine and expanded agent governance ↗
- Google Cloud – Inside Agent Compute Engine (technical deep dive) ↗
The evidence was reviewed against the cited primary documents; no independent product or lab test was performed.
Frequently asked questions
Can Google Cloud customers use Agent Compute Engine now?
Google says the platform already runs internal Gemini services, with an external customer preview targeted for the coming months.
Does every agent really run in a separate VM?
Google's architecture describes a dedicated hardware-isolated microVM per agent session. Independent tenant testing is not provided in this report.
Does isolation alone solve enterprise privacy and security?
No. Permissions, identity delegation, data residency, contract terms, logging and independent security testing still matter.