Google's Agent Compute Engine Gives Every AI Agent Its Own Computer

Google Cloud has built a new home for AI agents, and it comes with locks on every door. The company unveiled Agent Compute Engine on October 22 at the AGNTCon + MCPCon events, a compute service purpose-built for running AI agents at scale. It is not a lab prototype waiting for its first customer: according to the Google Cloud blog, Agent Compute Engine already powers Gemini as an agent for work tasks, and customers can expect a preview in the coming months.

The launch is the clearest sign yet that the cloud giants now treat agents as a distinct workload class, one that needs its own infrastructure the way mobile apps once needed their own. A chatbot answers a question and stops. An agent might browse the web, write code, run that code, check the result, and try again, all without a human clicking anything. That autonomy is exactly what makes agents useful, and exactly what makes them dangerous to run on shared infrastructure.

One MicroVM per Agent

At the core of Agent Compute Engine is a simple idea: every agent session gets its own hardware-isolated microVM, complete with a dedicated guest kernel, root access, and attached storage. Google describes it as VM-grade isolation with container-like speed and density, combining the hardware efficiency of containers with the security of traditional virtualization.

Google splits every agent into two parts. The harness, or "brain," calls the model and dispatches explicit commands. The sandbox, or "hands," executes those commands: running code, shell commands, and browsers. Crucially, the harness runs fully outside the sandbox, and the sandbox holds zero credentials. Credentials are injected at the egress gateway, outside the microVM, so a prompt-injected agent can still make the calls that policy allows but has no key to leak and reuse elsewhere, according to Google Cloud's announcement.

The physical layer is equally locked down. The microVMs run on Google-managed hosts using Titan silicon and the Titanium IPU, with firmware integrity verified by Google's custom security chips and mitigations against side-channel attacks built into the CPUs, as reported by SiliconANGLE. The host appliances are stateless, meaning they do not permanently retain customer files, and what they do store sits in an immutable file system that cannot be modified or deleted. MicroVMs get only limited access to the appliance's storage, so a compromised sandbox cannot read or delete data beyond its walls.

Why Agents Cannot Just Live in Containers

Agents create two problems for a cloud provider. The first is scale: agents appear and vanish constantly, spinning up for a single task and dying seconds later. The second is containment: an agent with root access in a poorly isolated environment is a risk to everything around it.

Agent Compute Engine answers the scale problem with copy-on-write memory sharing. When many agents start from the same base image, they share the same memory until one of them changes something, at which point only that agent gets a private copy of the altered part. Google says the approach has delivered benchmarks of 10x density, meaning the company claims it can pack far more agents onto the same hardware than otherwise possible, as Crypto Briefing reports. Idle agents are checkpointed to zero active resources and resumed from snapshots, so capacity is not burned while an agent waits.

That idle-time behavior may be the real economic story. In a pricing example from AWS's own documentation, memory accounts for about 68% of the cost of an agent session even when the agent sits idle 90% of the time. Whether a platform can release not just CPU but also memory while an agent waits could determine who wins the cost war for large agent fleets. Google has not published pricing or independent validation of its density claim, so the preview period will be the first real test.

The Governance Layer Comes Along for the Ride

Compute is only half the announcement. Google is also extending the agent governance capabilities of its Gemini for business platform to support agents wherever they operate, adding token tracking, model routing, and support for outside identity providers including Ping Identity and SailPoint, according to Oossa. Those controls will extend beyond Agent Compute Engine itself to Cloud Run, Google Kubernetes Engine, and managed endpoints.

The governance push lands in an industry that is suddenly obsessed with controlling agents. Microsoft's Project Perception now treats AI agents as insider threats, banks are blocking agents from touching customer money without human approval, and research from Arrakis found dormant agents quietly keeping credentials and trigger paths open. Against that backdrop, the Agent Compute Engine pitch is that control and isolation should be infrastructure, not an afterthought bolted on by every enterprise customer.

The Race for the Agent Stack

Google is not first to the microVM idea. AWS's AgentCore Runtime got hardware-isolated agent sandboxes to market earlier, so the competitive difference may lie in idle-time economics and governance depth rather than the isolation concept itself. One community reaction to the announcement raised the audit question: when a session lives for ninety seconds and its machine vanishes, what record survives of what the agent was asked to do and why it picked the action it took? Isolation says what an agent could touch, not whether it did the right job.

Google also open-sourced a sibling project, Agent Substrate, a Kubernetes runtime built on the same approach that runs on any cluster. In Google's testing it handled 500 activations per second with suspend and resume under 500 milliseconds across 200,000 agents, as MarkTechPost reports. That gives teams a path to the same architecture without committing to Google Cloud, and it gives the company a way to seed its agent-infrastructure pattern across the ecosystem.

For now, the details that matter most are the ones Google has not shared: the preview date, the pricing, and independent confirmation of the 10x density claim. But the direction is unmistakable. Every agent getting its own secure computer is becoming the industry pattern, and the cloud providers are racing to define what an "agent computer" looks like, how it is billed, and who governs it. Agent Compute Engine is Google's bid to set that standard.

Sources: Google Cloud Blog: Introducing Agent Compute Engine and expanding agent governance; Crypto Briefing: Google Cloud unveils Agent Compute Engine for AI agents; SiliconANGLE: Google Cloud introduces Agent Compute Engine to host AI agents; MarkTechPost: Google Cloud Launches Agent Compute Engine; Oossa: Google plans isolated virtual machines for Gemini agents.