The Pulse
Google Gives Each Agent Its Own Hardware-Isolated MicroVM
Google plans to offer Agent Compute Engine, the microVM infrastructure behind Gemini agents, to Google Cloud customers in preview later this year. The service isolates each agent session and routes credentials outside its sandbox, while a s
AI.info Team · Written with AI · fact-checked ·
Google plans to give every AI agent session its own hardware-isolated microVM, then sell the infrastructure behind Gemini’s agents as a Google Cloud service. Announced Thursday, October 22, at the Linux Foundation’s AGNTCon+MCPCon in San Jose, Agent Compute Engine is expected to enter preview later this year, according to The New Stack’s report.
The move takes an internal system and offers it to cloud customers building agents that run code or use tools. Google says the infrastructure grew out of its work on Gemini, Antigravity and model-training pipelines. The company’s pitch centers on pairing VM-level isolation with the fast startup and flexible use associated with containers; pricing and specific preview access requirements were not given in the report.
Each session gets its own boundary
The reported design treats the agent sandbox as untrusted. Each session runs in a single-tenant, memory-safe microVM, with no secrets stored in the sandbox’s memory or on disk. Network traffic passes through an external proxy, while Agent Gateway attaches credentials outside the sandbox.
The host is treated as a stateless appliance with read-only storage, and the microVMs run on Cloud Hypervisor, according to the report. It also describes the system as built on Google’s Titan and Titanium IPU security platform. These are architectural claims, not evidence that every risk from an agent’s code execution or tool use disappears: isolation of the runtime does not, by itself, determine what an agent is authorized to do.
That separation matters as agents move beyond generating responses and begin executing code, calling services and retaining working state between steps. A dedicated environment can limit what a session can directly reach, while a proxy-mediated path for credentials keeps the secrets themselves outside it. The practical security boundary still depends on how the proxy grants access and how organizations configure an agent’s permissions.
Agent Compute Engine joins Google’s Kubernetes work
The cloud service is distinct from Agent Substrate, Google’s open-source project for running agent sandboxes on Kubernetes. Google announced Agent Substrate in May alongside Agent Executor, a runtime for agent execution and resumption. The company describes Substrate as a way to move agents onto and off ready compute capacity rather than reserving active resources for agents that are waiting.
Google’s September infrastructure update says Agent Substrate is designed to run millions of sandboxes at up to 10 times the density of standard container runtimes. The company also reports resume operations under 500 milliseconds and more than 500 suspend-and-resume activations per second. Those are Google’s stated performance figures; the cited update does not provide an independent benchmark.
Substrate addresses a different deployment choice from Agent Compute Engine: teams can use a Kubernetes runtime rather than wait for a managed Google Cloud service. In its May announcement, Google said Substrate’s lightweight control plane is built for millions of sub-second tool calls, which it says could overwhelm a standard Kubernetes control plane. The company’s September figures add a measure of the claimed density and resume speed, but do not establish how the system performs across different workloads.
The preview will test the case for managed isolation
Google enters a market that already includes agent-sandbox services from E2B and Daytona, as well as AWS Bedrock AgentCore, according to The New Stack’s report. Google also offers other sandboxing options through GKE and Gemini Enterprise Agent Platform. Agent Compute Engine’s distinction is its origin as infrastructure used inside Google, now being positioned as a cloud product for customers.
For developers, a managed per-session microVM could reduce the work of building and operating isolated environments. For security teams, the key questions are more specific: what credentials can pass through Agent Gateway, how network destinations are controlled, and what state persists when a session pauses or ends. Google’s announced preview will show whether customers can inspect and configure those boundaries, and what the service costs at scale.
Google has not yet provided a public launch date beyond saying the preview is expected later this year. The Linux Foundation event runs October 22–23, 2026; the announcement itself came on October 22. Until Google publishes access terms, pricing and more implementation detail, customers have an architecture description, not a service they can evaluate against their own workloads.