Google Introduces Agent Compute Engine with MicroVM Sandboxes
Announced at AGNTCon + MCPCon, the service pairs microVM sandboxes with fast suspend-and-resume mechanisms to lower agent infrastructure overhead.
In short
- Google launched Agent Compute Engine to tackle idle-time infrastructure overhead by providing each autonomous agent with a dedicated, hardware-isolated microVM.
- The architecture decouples the agent harness from the execution sandbox, leaving zero stored credentials inside the guest environment.
- Idle sandboxes are checkpointed to release active compute resources, while copy-on-write memory sharing reduces RAM footprint across concurrent agents.
- Alongside the proprietary engine, Google offers the open-source Agent Substrate runtime for Kubernetes clusters on GKE and other clouds.
- Analysts emphasize that net enterprise savings depend on idle duration, while potential trade-offs include higher storage fees and state synchronization challenges.
On October 22, 2026, Google announced Agent Compute Engine, a purpose-built cloud infrastructure service engineered to run autonomous artificial intelligence agents inside dedicated, hardware-isolated microVMs. Unveiled at the AGNTCon + MCPCon event, the service is designed to tackle the steep resource costs of AI agents that sit idle between task steps, human approvals, and API calls. According to Google Cloud's announcement, the system already runs internally to host Gemini for enterprise work tasks and will become available in customer preview in the coming months.
Running autonomous agents presents unique infrastructure hurdles compared to standard web applications. While conventional software processes continuous streams of requests, agentic workloads operate in iterative, high-churn loops. They trigger code execution, manipulate browsers, and call external tools, but spend the majority of their session lifetimes waiting for language models to finish generation or waiting on human feedback. Traditional virtual machines run continuously during those waiting periods, racking up infrastructure bills for idle capacity.
Solving Idle Costs with Fast MicroVM Checkpointing
To prevent enterprises from paying for unused compute, Agent Compute Engine isolates each agent session into an individual microVM backed by Cloud Hypervisor. When an agent finishes executing an action and moves into the "thinking" phase of its loop, the sandbox signals that it has entered an idle state. The host system then checkpoints the microVM, freeing its active processing resources, as reported by SiliconANGLE. When the model or user sends the next instruction, the microVM resumes from its snapshot.
This suspend-and-resume mechanism is combined with memory optimization. Google utilizes copy-on-write memory sharing via direct access (DAX) mapping against pre-warmed operating system images. This design allows hundreds or thousands of agent sandboxes on a single physical machine to read from common operating system and runtime library pages, with private RAM dedicated solely to pages modified by a specific agent.
Storage is split across three distinct tiers: disposable scratch overlays for ephemeral runtime artifacts, shared read-only volumes for core system dependencies, and dedicated Hyperdisks assigned to each microVM. By assigning each sandbox its own Hyperdisk, Google enables execution workspaces and context files to persist across multi-session tasks without keeping compute nodes pinned.
Architecture and Zero-Trust Sandbox Security
Autonomous agents execute dynamic, model-generated code and handle external inputs, making them prime targets for prompt injection and sandbox escape attempts. As detailed by MarkTechPost, Google operates under a threat model that assumes an attacker has gained complete control inside the sandbox. To mitigate that risk, Agent Compute Engine splits execution into two parts: an external harness acting as the "brain" that invokes models and dispatches tasks, and the isolated sandbox acting as the "hands" that runs shell commands and browser automation.
MicroVMs do not possess standard network interfaces, default gateways, or direct Virtual Private Cloud (VPC) connections. Outbound traffic must pass across a virtio-vsock boundary to a local mediation proxy, which forwards requests to Google's Agent Gateway. The sandbox contains no static credentials, API keys, or enterprise secrets. Instead, the guest receives only a short-lived SPIFFE certificate identifying the session. When the agent requests external tools or data, Agent Gateway verifies the policy scope and injects authentication tokens on the wire outside the microVM.
At the physical layer, Agent Compute Engine appliances run on Google-managed servers equipped with Titan security silicon and Titanium Infrastructure Processing Units (IPUs). The Titanium IPU isolates hypervisor management and attestation keys outside the host guest environment, while the appliance hosts run stateless configurations protected by dm-verity read-only filesystems.
Agent Substrate Brings Density to Kubernetes
For engineering teams operating existing clusters or running multi-cloud deployments, Google introduced an open-source sibling called Agent Substrate. Running on Google Kubernetes Engine (GKE) since September 15, 2026, and available via an open-source repository, Agent Substrate decouples agent execution from node management.
According to Google, Agent Substrate supports both Cloud Hypervisor microVMs and gVisor sandboxes, offering up to 10 times higher compute density compared to standard compute instances. In benchmark tests managing 200,000 agents, Google reported that Agent Substrate maintained 500 activations per second while keeping suspend-and-restore latency under 500 milliseconds. The runtime also supports over 1,000 dormant agents on a single host and connects with Filestore agent volumes for shared persistent workspaces. It functions across multiple agent harnesses, including Claude Code, OpenClaw, and Nous Research's Hermes.
Expanding the Enterprise Governance Stack
Alongside Agent Compute Engine, Google expanded its Gemini for business governance stack to support distributed agent runtimes across Cloud Run, GKE, Agent Runtime, and client devices. The control suite includes four primary pillars:
- Agent Gateway: An orchestration broker that manages inbound and outbound agent traffic, applying sensitive data screening and runtime policy checks.
- Agent Registry: A directory that acts as the single source of truth for approved agents, tools, Model Context Protocol (MCP) servers, skills, and model endpoints.
- Agent Identity: A credentialing system that issues open-standard SPIFFE identities to authenticate every tool hop and sandbox session.
- Agent Observability: OpenTelemetry-compliant tracing and metrics that track distributed execution hops across models and tools.
According to The Decoder, Google plans to roll out preview capabilities this quarter for token tracking, model routing, and delegated authorization integrations with Ping Identity, SailPoint, and Saviynt. Policy enforcement using Envoy proxies for hybrid and multi-cloud environments, as well as local OS-level governance for coding agents on managed endpoints, are scheduled to enter preview soon.
Trade-offs, State Risks, and Industry Reality
While Google positions Agent Compute Engine as a key architectural step for agent deployment, analysts and cloud architects point to operational hurdles. As reported by InfoWorld, AWS has operated per-session microVMs in its AgentCore service with pause-based billing since 2025, and Microsoft provides suspended agent sessions within Foundry. Google's differentiator is holding full memory and execution state across microVM checkpoints rather than purely tearing down environments to disk.
That mechanism introduces specific software reliability risks. Amit Kumar Jena, AI development head at Kanerika, told InfoWorld that pausing during external transactions creates idempotency risks: if an agent suspends between issuing an external API call and receiving its confirmation, it may repeat payments or code commits upon resuming. Jena also warned that maintaining persistent disks across thousands of dormant agents can cause storage bills to offset compute savings.
Additionally, Pareekh Jain of Pareekh Consulting noted that Agent Compute Engine relies heavily on proprietary Google Cloud identity and networking components, increasing vendor lock-in risks for enterprises trying to maintain portable multi-cloud footprints. For continuously active agents that rarely sleep, principal analyst Manoj Chandra Jha noted that the financial benefits of suspend-and-resume infrastructure will remain minimal.
Questions people ask
What is Google Agent Compute Engine?
Agent Compute Engine is a specialized Google Cloud infrastructure service that provides each AI agent with a hardware-isolated microVM, designed to pause during idle periods to reduce server resource usage.
How does Agent Compute Engine differ from standard virtual machines?
Unlike traditional VMs, Agent Compute Engine microVMs boot rapidly, share read-only operating system memory through copy-on-write mechanisms, and automatically checkpoint memory to sleep when an agent waits for input or tool responses.
What is Agent Substrate?
Agent Substrate is an open-source, Kubernetes-native runtime that brings agent suspend-and-resume mechanisms, high-density host packing, and microVM or gVisor isolation to GKE and other Kubernetes clusters.
When will Agent Compute Engine be publicly available?
Google plans to launch a customer preview of Agent Compute Engine in the coming months, while governance extensions and token management features are scheduled for preview later this quarter.
Sources
- Introducing Agent Compute Engine and expanding agent governanceGoogle Cloud, Oct 22, 2026, official source
- Google Cloud Launches Agent Compute Engine: A MicroVM per AI Agentmarktechpost.com, Oct 22, 2026
- Google Cloud introduces Agent Compute Engine to host AI agentsSiliconANGLE, Oct 23, 2026
- Google's Agent Compute Engine gives every Gemini agent its own hardware-isolated micro virtual machineThe Decoder, Oct 22, 2026
- Google targets AI agents’ idle-time costs with new compute serviceInfoWorld, Oct 23, 2026
How this story was made: the newsroom picked it up from the-decoder.com and Google Search, gathered the full text of the sources above, and drafted it with AI assistance. Every factual claim was then checked against those sources before publishing (39 claims checked). Illustrations marked as AI-generated are not photographs. Spotted an error? Tell us.
Published October 24, 2026 at 03:05 UTC
