Google Cloud launches Agent Compute Engine to isolate AI agents in microVMs

Google Cloud announced Agent Compute Engine on Oct. 22, 2026 at AGNTCon + MCPCon in San Jose, California. The fully managed service gives every AI agent its own hardware-isolated microVM. It will enter customer preview in the coming months. Google Cloud already uses the service as internal infrastructure for its own Gemini agents.

Each microVM runs on Google’s Titanium Infrastructure Processing Unit, a dedicated processor separate from the host CPU. Titanium holds the private attestation keys for each microVM outside the guest environment. The processor acts as a security hardware layer for the microVMs. Its role as root of trust keeps the private attestation keys away from the guest environment.

An attestation key is a cryptographic key used to prove that a platform’s software and hardware have not been tampered with.

A microVM is a lightweight virtual machine with its own guest kernel and root access, unlike containers that share the host kernel. The hardware virtualization boundary creates a separate execution environment for every agent. Agent Compute Engine microVMs boot in approximately 125 milliseconds and impose roughly five MiB of memory overhead per agent.

The machines have their own Hyperdisk for persistence of execution workspaces and agent context. The Hyperdisk stores execution workspaces and agent context across sessions. Checkpoint-restore snapshots a microVM’s complete state during idle phases and restores it in under 500 milliseconds. Copy-on-write memory sharing lets agents on the same operating system template share physical memory pages and keep only individual modifications as private pages.

Agent Compute Engine appliances use a stateless architecture with an immutable file system and Titan security chips for firmware integrity. The stateless design means appliances do not retain local state between sessions. Titan security chips verify firmware integrity at boot. CPUs in the appliances include mitigations against side-channel attacks, which extract information from physical effects such as power use or timing rather than breaking software directly.

A side-channel attack extracts information from physical effects such as power use or timing rather than breaking software directly.

Service credentials are never transmitted to, stored in, or accessible from inside the agent microVM. The Agent Gateway inserts backend service credentials onto the wire at network egress after validating the agent’s identity. Each microVM receives an ephemeral session-scoped SPIFFE certificate plus a short-lived token that proves agent identity but carries no backend service credentials. SPIFFE is a framework for workload identity that allows systems to verify the identity of a requesting agent.

Network egress is the point where traffic leaves a network or system boundary.

The Agent Gateway validates the user delegation token, the agent’s SPIFFE identity, and the Titanium-attested node identity before performing an in-flight token swap. Traffic from microVMs traverses an isolated point-to-point IPC boundary terminating at a local unprivileged mediation proxy before an external gateway enforces outbound policy. An IPC boundary enables processes in separate isolation domains to exchange messages without sharing memory directly. A mediation proxy is an intermediary that forwards network traffic between two points without running with elevated privileges.

The in-flight token swap happens after all three identities are confirmed.

Google’s stated design rule assumes an attacker controls everything inside the sandbox and finds nothing there to use. A sandbox is a restricted environment that limits what code running inside it can access. A prompt injection attack that takes full control of an agent finds no credentials to steal because none exist inside the sandbox.

Even if an attacker achieves full control inside the agent, there are no credentials to exfiltrate. Credential reuse happens when stolen login information is used to access other systems.

Prompt injection ranked first on the OWASP Top 10 for LLM Applications. Web-based indirect injection attacks struck production AI systems 12 times during the first three months of 2026, security researchers said. Google’s threat research team reported a 32 percent increase in malicious injection payloads targeting LLM-integrated applications between November 2025 and February 2026. The EchoLeak vulnerability CVE-2025-32711 rated CVSS 9.3 exploited indirect prompt injection in Microsoft 365 Copilot to exfiltrate user data.

CVE is a common vulnerability and exposure identifier used to track security flaws.

AWS introduced AWS Lambda MicroVMs on June 22, 2026. Docker launched Docker Cloud Sandboxes on September 24, 2026. DigitalOcean entered private preview for a Firecracker-based MicroVM service targeting agent infrastructure builders in October 2026.

Firecracker is an open-source KVM-based virtual machine monitor that AWS open-sourced in December 2018 and uses to process trillions of Lambda executions monthly. KVM stands for kernel-based virtual machine, a virtualization technology built into the host operating system kernel. A Firecracker-based service uses the Firecracker virtual machine monitor to create lightweight microVMs. AWS’s Lambda MicroVMs handle multi-tenant user-generated and AI-generated code in sessions that run as long as eight hours.

Agent Substrate on GKE is an open-source runtime available now that runs on any Kubernetes cluster including on-premises and multi-cloud environments. GKE refers to Google Kubernetes Engine, a managed service for running Kubernetes clusters. Kubernetes is a system for managing containerized applications across clusters. Agent Substrate sustained 500 activations per second at less than 500 milliseconds suspend and resume latency in a benchmark of 200,000 agents.

Agent Substrate delivers as much as 10 times higher compute density than traditional compute while maintaining full kernel isolation. It uses either gVisor or Cloud Hypervisor for kernel isolation. gVisor and Cloud Hypervisor are isolation options that provide separate kernels for workloads.

Google expanded its Gemini for business agent governance platform to cover multi-cloud, on-premises, and managed endpoint devices. An endpoint device is a piece of hardware such as a laptop or phone that connects to a network. The governance stack includes Agent Gateway, Agent Registry, Agent Identity, and Agent Observability. Token and cost governance capabilities are arriving in preview this quarter.

Model routing policies direct requests to the right model based on cost and performance objectives.

Token management lets enterprises attribute compute spend per agent and enforce budget guardrails. Agent Gateway will roll out alongside Agent Compute Engine in the coming months with model routing and inference cost regulation.

Gautham Thambidorai, VP & Google Fellow, Gemini, said “Scaling the Gemini agent to planet scale requires compute that spins up rapidly and operates with extreme efficiency.” Hervé Bizira, Chief Business Officer, Nous Research, said “Agent Substrate addresses both at the platform layer in a way that also preserves valuable compute resources.”

Ramanathan Venkatapathy and Rohit Jnagal, Google Cloud distinguished engineers, said “This boundary terminates at a local, unprivileged mediation proxy, which forwards packets to an external proxy.” Outbound policy controls which external destinations a system is allowed to contact.

Agent Compute Engine microVMs give agents root access inside a persistent sandbox for shell scripts, headless-browser use, and code-writing loops lasting weeks. Google is hosting an AI Infrastructure Future event on Nov. 9 focused on co-designed open systems for scaling agentic AI. Co-designed open systems are built collaboratively with publicly available specifications.