Google gave every AI agent its own computer

Agent Compute Engine is Google Cloud's purpose-built compute service for running AI agents. The company says it started as internal infrastructure for Gemini, Antigravity, and its own model-training pipelines, and it already powers Gemini as an agent for work tasks. Google announced it on October 22, 2026, at the Linux Foundation's AGNTCon + MCPCon in San Jose, and says a customer preview will open in the coming months.

Alongside it, Google is extending its Gemini for business agent-governance stack — Agent Gateway, Agent Registry, Agent Identity, and observability — to cover agents wherever they run: Google Cloud runtimes such as Cloud Run and Google Kubernetes Engine, with cross-cloud, on-prem and managed-endpoint coverage described as in preview soon. The announcement was authored by Google Cloud product leaders Nirav Mehta, Michael Bachman, and Kevin Hutchins.

Each agent gets a persistent, sandboxed microVM behind a hardware-isolated Cloud Hypervisor boundary, with its own guest kernel and root access, running on hosts with Google's Titanium infrastructure processing unit. Inside that machine the agent can run shell scripts, drive a headless browser, and write code — in workspaces that can persist across days or weeks.

The security design assumes the agent cannot be trusted with secrets. The sandbox never holds user credentials or API keys: outbound requests go through a local proxy to the off-node Agent Gateway, which validates the user delegation, the agent identity, and the node identity, then performs an in-flight token swap — inserting the backend credential as the request leaves the gateway. Each microVM gets its own cryptographically verified ID and runs its agent's own short-lived identity, so if a prompt injection hijacks an agent's behavior, there are no credentials inside to steal.

For efficiency, Agent Compute Engine uses copy-on-write memory sharing to pack multiple agents onto a single OS template, and it pauses idle microVMs via fast checkpoint and restore. When an agent finishes a tool call and enters the “thinking” phase of the agentic loop, the microVM signals it is idle, the host moves it to an idle state, and it resumes from a snapshot when work returns. Each microVM also gets its own Hyperdisk, so execution workspaces and agent context persist across sessions.

For teams standardized on Kubernetes, Google released Agent Substrate: an open-source execution runtime on GKE with the same agent-first, zero-trust design. Sandboxes get strong hardware isolation using the agent team's choice of microVM or gVisor, every agent gets a cryptographically secure identity, and egress proxies enforce granular network policies while injecting credentials outside the agents' reach. It works with any agent framework or harness — Google names Claude Code, OpenClaw, and Hermes — and integrates with Filestore agent volumes for a shared multi-agent workspace.

Google attaches headline numbers to Substrate, all company-reported: up to 10x higher compute density than traditional compute, and a benchmark validation running 200,000 agents that sustained 500 activations per second at under 500 ms suspend and resume latency. Nous Research is already using the architecture to deploy multi-tenant agents into existing customer infrastructure. Unlike Agent Compute Engine itself, Agent Substrate can be tried on GKE today.

“Agent Substrate addresses both [per-agent isolation and extensible access control] at the platform layer in a way that also preserves valuable compute resources. Our experience with Agent Substrate gives us confidence the architecture can scale efficiently as agent workloads grow,” said Hervé Bizira, Chief Business Officer at Nous Research.

The launch lands in a crowded fortnight for agent containment. Independent coverage frames it as part of an industry-wide verdict that containers are the wrong primitive for agents that execute untrusted content, call external tools, and run model-generated code. Microsoft made its OS-enforced Execution Containers generally available on Windows 11 on October 7 (policy-driven containment rather than hardware isolation), and NVIDIA's OpenShell Reference Architecture, announced October 21, put out-of-band hardware enforcement at the center of safe agents. Three tech giants converging on enforcement outside the agent within about two weeks is the signal.

The caveats are Google's own fine print: Agent Compute Engine itself ships no public performance figures, no boot-time or density numbers, and no pricing — all of that is promised with the preview ‘in the coming months.’ The 10x density and 200,000-agent figures belong to the open-source Substrate and have no independent validation yet. And the governance half — token and cost controls, model routing, cross-cloud policy enforcement points — mostly arrives in preview, ‘this quarter’ for token and cost governance and model routing and ‘soon’ for cross-cloud and endpoint coverage, so enterprises get the architecture before the meter.

“Scaling the Gemini agent to planet scale requires compute that spins up rapidly and operates with extreme efficiency. Agent Compute Engine microVMs give us the responsiveness, hardware isolation, and workload density needed to deliver interactive agent sandboxes to our users around the world,” said Gautham Thambidorai, VP and Google Fellow for Gemini.