Google Cloud Unveils Agent Compute Engine With a MicroVM per AI Agent

MarkTechPost reported that the service already powers Gemini as an agent for work tasks, as well as Antigravity and internal evaluation and reinforcement-learning pipelines. Google describes the pitch as VM-grade isolation with container-like speed and density, although it has not published boot time, density or pricing figures for Agent Compute Engine itself.

Each agent session runs in a single-tenant microVM behind a Cloud Hypervisor boundary, with its own guest kernel, root access and Hyperdisk. Google splits every agent into two parts: a harness, or “brain,” that calls the model, and a sandbox, or “hands,” that runs code, shell commands and browsers. The harness runs fully outside the sandbox and dispatches explicit commands into it. The microVMs run on Google-managed hosts using Titan silicon and the Titanium IPU.

The networking design is central to the isolation model. MicroVMs have no standard network interface, no default gateway and no direct VPC access. All traffic crosses a virtio-vsock boundary to a local proxy and then to an external gateway. Guests receive only a session-scoped SPIFFE certificate and a short-lived identity token. Agent Gateway swaps in the real backend credential in flight after policy checks. Google says it assumes an attacker controls everything inside the sandbox, so a prompt-injected agent finds no secrets to steal.

Google defines four identities for every agent workload. A user identity authenticates the overall task only. A delegated on-behalf-of identity is a scoped grant stored in a central authorization service and never on the node. Agent Workload Identity is a short-lived SPIFFE identity and the only one used for sandbox traffic. Agent Workforce Identity is an agent’s own account and resources. According to Google, the workload identity is useless for direct API calls if exfiltrated and only identifies which sandbox sent a packet.

To keep idle agents cheap, Google checkpoints idle microVMs to zero active resources and resumes them from snapshots on the next call. Density comes from copy-on-write memory sharing. Pre-warmed snapshot images are mapped with DAX, so microVMs on a host share base OS and library pages, and only each agent’s modified pages consume private memory. Harnesses also get cloning, snapshot and forking, rewind and rollback. Storage is split among disposable scratch overlays, shared read-only volumes and persistent user workspaces on Hyperdisk.

Google also offers an open-source sibling, Agent Substrate, which runs on any Kubernetes cluster. MarkTechPost reported that Agent Substrate reached 500 activations per second at under 500 milliseconds suspend and resume across 200,000 agents. Those figures do not cover Agent Compute Engine itself, for which Google has not published boot time, density, pricing or a specific preview date.