Google Agent Compute Engine Gives Each AI Agent Its Own MicroVM

Google Cloud is turning the infrastructure that runs its own Gemini agents into a product. At AGNTCon + MCPCon in San Jose on October 22, 2026, the company announced Google Agent Compute Engine, a purpose-built compute service that gives every AI agent its own hardware-isolated microVM. The service already powers Gemini agents handling work tasks, according to Google, and will open to customers in preview in the coming months.

The Google Agent Compute Engine announcement matters because agents do not behave like ordinary software. An agent spends most of its life waiting: waiting on a model response, waiting on a tool, waiting on a human approval. Keeping a full machine reserved for an agent that is mostly idle is expensive, and giving that agent broad credentials is risky. Google Agent Compute Engine is built around both problems at once: isolate each agent, and stop paying for it while it waits.

Google Agent Compute Engine: a microVM per agent, with no secrets inside

Each Google Agent Compute Engine microVM runs behind a hardware-isolated Cloud Hypervisor boundary, with its own guest kernel and root access, on hosts using Google's Titanium infrastructure processing unit. The agent inside gets a persistent workspace on Hyperdisk, so its context survives across sessions, and it can run shell scripts, drive a headless browser, and write code in loops that could run for weeks, according to coverage of the announcement.

The security design keeps credentials out of the sandbox entirely. The microVM never holds user credentials or API keys. Instead, outbound requests pass through a local proxy to the off-node Agent Gateway, which validates user delegation, agent identity, and node identity, then inserts the backend credential as the request leaves the gateway. Each microVM also carries its own short-lived identity, and service credentials are injected only as traffic exits the sandbox.

Idle handling is the second half of the Google Agent Compute Engine design. When an agent finishes a tool call and enters a thinking phase, the microVM signals that it is idle and the host pauses it through checkpoint and restore, resuming it later from a snapshot. Copy-on-write memory sharing lets instances share a common operating-system template and copy data only when it changes, which keeps the cost of each paused agent low.

Agent Substrate: the open-source twin for Kubernetes teams

Alongside Google Agent Compute Engine, Google pointed Kubernetes users to Agent Substrate, an open-source runtime built on the same approach. Agent Substrate works with any Kubernetes cluster and any agent framework or harness, according to Google, and it can be tried on Google Kubernetes Engine today. It offers per-agent kernel isolation using either microVM or gVisor sandboxes, and it carries the headline numbers in the announcement.

Google reported that a validation involving 200,000 agents sustained 500 activations per second, with suspend-and-resume latency below 500 milliseconds. The company also claimed up to 10 times the compute density of traditional compute. Those figures describe Agent Substrate, not Agent Compute Engine, a distinction that matters: the managed service publishes no density number, no boot time, and no price yet, while the open-source runtime can be measured by teams running it themselves.

Google cited Nous Research as one team using Agent Substrate to deploy multi-tenant agents into existing customer infrastructure. For platform teams already running Kubernetes, the portability argument is the point: the same agent runtime can run on premises, across clouds, or on Google's managed service, without rewriting the agent.

Governance travels with the agents

Google Agent Compute Engine arrives with expanded governance controls around its agents. The company named four parts of the offering: Agent Gateway, Agent Registry, Agent Identity, and agent observability. The Gateway mediates traffic between clients and agents and from agents to other services, with policy and security controls. The Registry catalogs approved agents, tools, MCP servers, skills, models, and endpoints.

Agent Identity assigns each agent a secure identifier based on SPIFFE, while observability built on OpenTelemetry covers metrics, logs, and traces for model calls, tool use, and agent hops. Google said governance for local agents on managed devices, plus cross-cloud and hybrid policy enforcement, would enter preview soon, and additional Gateway features including cost controls and model routing were expected in preview this quarter. L'Oréal's AI lead described using Google Cloud governance across runtimes such as Cloud Run, according to coverage of the event.

Why the runtime is becoming the product

Google is not alone in betting that the agent runtime is now a product category of its own. Every major cloud provider that announced an agent compute service in 2026 chose microVM-based isolation, with AWS Lambda MicroVMs in June, Docker Cloud Sandboxes in September, and DigitalOcean MicroVMs in October, according to industry coverage. The convergence reflects a shared conclusion: agents with real capabilities need kernel-level isolation, and microVMs are the available primitive that delivers it at cloud scale with sub-second latency.

The same week brought related moves across the agent stack, from Google's Data Agent Kit for safe data access to Anthropic's lighter sandbox runtime for agents. The pattern is consistent: the industry is building the guardrails, runtimes, and data plumbing that let agents act in real systems without handing them the keys to everything.

What to watch next is concrete: when the Google Agent Compute Engine customer preview actually opens, what it costs, and whether independent teams reproduce the density and latency figures on their own workloads. Until then, teams choosing an agent platform face a genuine fork: Google Agent Compute Engine, Kubernetes portability through Agent Substrate, or another microVM runtime entirely. The model is no longer the only decision that matters. The runtime underneath it now is too.

Sources: NeoTeo, TechTimes, AppStack Insider.