Google opens its secure agent infrastructure to cloud customers

Google is preparing to release the internal infrastructure that powers its Gemini agents as a public cloud service. Announced at the Linux Foundation’s AGNTCon+MCPCon in San Jose, the Agent Compute Engine will enter preview for Google Cloud users later this year, offering hardware-isolated microVMs for AI agent execution.

What happened

The new service, Agent Compute Engine, provides every AI agent with its own isolated microVM. This architecture combines the rapid startup times of containers with the strong security boundaries of traditional virtual machines. The announcement marks a significant shift, as Google moves this technology from internal use for Gemini, Antigravity, and model training pipelines to a commercial offering for external developers.

This launch places Google in direct competition with other major providers offering agent sandboxes. Startups like E2B and Daytona already provide similar environments, often using Firecracker microVMs or container-based isolation. AWS also offers Bedrock AgentCore, which assigns each agent session its own microVM and pauses billing during idle wait times. Google’s entry leverages its massive scale, aiming to support the rapid growth of agentic workloads that have become some of the largest consumers of compute and storage in its data centers.

How it works

Agent Compute Engine addresses the tension between speed and security in agent execution. Traditional virtual machines offer strong isolation but are too slow to boot and suspend for the short-lived tasks typical of AI agents. Containers are fast but lack the kernel-level isolation required for safe code execution. Google’s solution uses a hardware-isolated microVM that boots quickly and can be checkpointed when idle. When an agent waits for a model response or user input, the host saves the microVM’s state to disk and releases active resources, resuming instantly when needed.

Security is built into the foundation of each session. Each microVM runs on a stateless host with a read-only filesystem, cryptographically verified at boot using Google’s Titan and Titanium IPU security platform. The microVMs themselves run on Cloud Hypervisor, an open source monitor, and each instance has its own guest kernel and root access. Crucially, these environments hold no secrets in memory or on disk. Identity is handled via short-lived, session-scoped tokens, and all traffic is encrypted. Network access is proxied outside the sandbox, with credentials injected only after verifying user delegation through Google’s Agent Gateway.

Key details

• Agent Compute Engine will be available in preview for Google Cloud users later in 2026.
• Each agent runs in a single-tenant, hardware-isolated microVM with its own guest kernel.
• The system checkpoints idle microVMs to free up active resources while preserving state.
• Security relies on Google’s Titan and Titanium IPU platforms for hardware verification.
• No secrets are stored in memory or on disk within the sandbox environment.
• All network traffic is proxied and encrypted, with credentials managed outside the VM.

Why it matters

For engineers building agentic systems, security remains the primary barrier to adoption. Agents often require root-level access to execute code, browse the web, or interact with shell scripts, creating significant risk if they are compromised. By providing a sandbox where an attacker controlling the agent finds nothing of value, Google reduces the liability associated with running untrusted code. This "nothing to steal" approach allows developers to grant agents broader permissions without exposing sensitive infrastructure or credentials.

The efficiency gains from checkpointing idle agents also impact cost and scalability. Since agents spend most of their time waiting for external inputs, paying for full compute resources during these periods is wasteful. By suspending the microVM and releasing active CPU resources, the infrastructure can support higher densities of concurrent agents. This model supports long-running loops that may last for weeks, enabling complex workflows like reinforcement learning and large-scale model evaluation that were previously difficult to manage economically.

What you can do

• Monitor the Google Cloud console for the Agent Compute Engine preview launch later this year.
• Evaluate current agent workloads to identify tasks requiring root-level isolation versus simple containerization.
• Review security protocols for agent credential management to align with proxy-based identity models.
• Consider testing Agent Substrate on existing Kubernetes clusters if a managed service is not preferred.
• Benchmark agent suspension and resume times to estimate potential cost savings from idle checkpointing.
• Explore integration with tools like Claude Code or OpenClaw if using the open source Substrate runtime.