Google Cloud Launches Agent Compute Engine: A MicroVM per AI Agent

Google Cloud announced Agent Compute Engine, a service that gives each AI agent session its own hardware-isolated microVM, with no credentials stored inside the sandbox. It already runs Gemini as a workplace agent and Google's Antigravity tooling, and a customer preview is targeted for the coming months.

The bigger shift is the security posture. Google's design assumes an attacker controls everything inside the sandbox. If a prompt-injected agent goes looking for secrets, there are none to steal. Real credentials are swapped in at a gateway, outside the box, after policy checks.

This is the most grown-up agent security design we've seen from a major cloud, and it's worth saying why. For two years the industry has bolted agents onto systems built for humans and hoped prompt filters would hold. Google splits each agent into a harness that talks to the model and a sandbox that runs code, shells and browsers. The sandbox gets no normal network interface, no default gateway and no direct access to the customer's network. Traffic crosses a narrow channel to a proxy, and the only identity inside is a short-lived certificate that, per Google, is useless for direct API calls if it leaks.

That's the right instinct. Prompt injection isn't a bug that gets patched once; it's a permanent condition of letting models read untrusted text. Building so a hijacked agent can't do much is better than pretending the hijack won't happen.

The economics matter too. Google says agents spend most of their time waiting on a model or a person, so idle microVMs get checkpointed down to zero active resources and resumed from snapshots. Its open-source sibling, Agent Substrate, already on GKE for non-production use, reported 500 activations per second with sub-500 ms suspend and resume in a 200,000-agent benchmark. If those numbers hold in production, per-agent isolation stops being a luxury.

Now the caveats. Agent Compute Engine itself has no published boot time, density figures, pricing or firm preview date. Isolation also doesn't solve the harder problem: an agent with legitimate, delegated access can still do the wrong thing with it. A sealed sandbox protects your keys, not your judgment about what the agent was allowed to do. And as more governance flows through one vendor's gateway, registry and identity stack, switching costs climb.

I'm watching whether this becomes the default pattern across clouds. If it does, agents get safer to deploy at scale. If it stays a premium Google feature, the long tail of companies running agents on whatever is cheapest stays exposed.

AWS, Azure and startups like E2B already offer per-session sandboxes for agents, so isolation itself isn't new. What stands out in Google's approach is keeping credentials entirely out of the sandbox and separating four distinct identities per agent workload, from the human user down to a short-lived workload identity. Google also said it is extending agent governance tools across Cloud Run, GKE and local coding agents in staged previews.