Google is bringing Agent Compute Engine to Google Cloud. The service gives each AI agent its own microVM with hardware isolation that boots as quickly as a container. The sandbox contains no credentials. Internally, Gemini, Antigravity, and Google’s training pipelines are already running on the platform.
Agentic workloads have quickly become one of the fastest-growing consumers of compute and storage. Agents write and run code, operate browsers, and execute workflows. According to the company, existing compute primitives aren’t designed to run hundreds of millions of these agents at acceptable costs and latency.
Traditional VMs provide good isolation, but starting, pausing, and resuming them takes seconds to minutes. Containers are fast. However, they share the host’s kernel, whereas coding agents require full isolation and root access. Agent Compute Engine aims to combine these two features and can also distinguish between when an agent is active and when it is idle.
No secrets in the sandbox
The basic premise: assume that an attacker has full control over everything inside the sandbox. Google gives the example of an agent that manages an inbox and reads an email containing hidden instructions to collect API keys. For this reason, a microVM contains no user credentials, API keys, OAuth refresh tokens, or service account keys. It also lacks a standard network interface. All traffic passes through virtio-vsock to a local proxy and then to the external Agent Gateway.
That gateway verifies the user, agent, and node, and only then issues the required token. Each sandbox is assigned a short-lived identity based on the open SPIFFE standard. If an attacker compromises that identity, they can’t use it to call a backend API. Google’s Titan chips and Titanium IPU keep cryptographic keys outside the guest environment.
Idle agents cost almost nothing
Interestingly, agents spend most of their time waiting, either for the model or for the user. The sandbox notifies the host when there are no more running tasks. The host then puts the agent into idle mode via checkpoint-and-restore, without consuming any active resources. As a result, Google says orders of magnitude more microVMs can fit on a single node than regular VMs. Furthermore, through DAX and Copy-on-Write, microVMs share the same physical RAM pages for the operating system, libraries, and binaries.
Through persistent workspaces, an agent can pick up where it left off the next day. Google distributes workloads globally across a single shared hardware pool. RL and evaluation jobs fill the gaps between peak periods of consumer and business users.
Agent Compute Engine will soon be available on Google Cloud. Developers choose the image, identity, network access, and lifecycle for each environment, while Google manages the underlying infrastructure. Teams with coding, evaluation, or RL pipelines can take a snapshot of an environment once and then fork it into thousands of copies.