AI agents are getting their own machines. Google Cloud has announced Agent Compute Engine, a compute service built specifically for AI agents, with one hardware-isolated microVM assigned to each agent session. The service already powers Gemini as an agent for work tasks, while customer preview is targeted for the coming months.
Each microVM gets its own guest kernel, root access, and Hyperdisk. The sandbox holds zero credentials, separating the agent’s working environment from the systems around it — a useful design choice when software is expected to act on a user’s behalf.
Google splits every agent into two parts: the harness, or “brain,” and the sandbox, or “hands.” Each session runs in a single-tenant microVM behind a Cloud Hypervisor boundary, giving the agent a contained place to perform tasks without turning the host into an all-you-can-eat buffet.
A sandbox designed to keep agents contained
Agent Compute Engine runs on Google-managed hosts using Titan silicon and the Titanium IPU. The hosts are stateless appliances with a read-only root filesystem enforced by dm-verity, while Titanium holds attestation keys outside the guest.
The microVMs also avoid the usual networking path. They have no standard network interface, no default gateway, and no direct VPC access; all traffic crosses a virtio-vsock boundary to a local proxy, then moves to an external gateway.
Guests receive only a session-scoped SPIFFE certificate and a short-lived identity token. Google defines four identities for every agent workload: User identity, Delegated on-behalf-of identity, Agent Workload Identity, and Agent Workforce Identity. That separation gives each request a defined identity instead of leaving one broad credential lying around inside the sandbox.
Storage follows the same divided model. Disposable scratch overlays handle temporary work, shared read-only volumes provide common data, and persistent user workspaces sit on Hyperdisk.
Google is also packaging the architecture for Kubernetes
Google’s open-source sibling, Agent Substrate, runs on any Kubernetes cluster. It is open to all GKE customers for non-production use, while production GA remains allowlist-only.
The performance targets are built around agents that spend much of their time waiting. Agent Substrate reached 500 activations per second at under 500 milliseconds for suspend and resume across 200,000 agents, and it can handle over 1,000 dormant agents per host.
The host checkpoints idle agents to zero active resources, then resumes them on the next call. Copy-on-write memory sharing and pre-warmed snapshot images help pack more workloads into the same infrastructure, with up to 10 times higher compute density than traditional compute.
That density matters because agent workloads do not behave like ordinary applications. An agent may need a full environment during a task, then sit idle while waiting for the next instruction. Keeping every session active would turn a large share of cloud capacity into expensive digital furniture.
Google’s architecture treats the session as the unit of isolation, identity, storage, and recovery. That gives developers a way to run agents with guest-level control while keeping network access, credentials, and host resources behind defined boundaries.
Agents are moving into Google’s own workflow
Sundar Pichai also described how AI agents assist him in managing Google. He uses agents to track model development and internal discussions, delegating some of the information-gathering that comes with running the tech giant.
“It could easily take me an hour a day to kind of catch up, what’s happened in the last 24 hours, right? But now I have agents running which summarize and bring that information to me. I can still go deeper, and I do so often,” Pichai said.
That example explains the appeal of a dedicated agent environment better than another promise about productivity. The agent gathers and summarizes information, while Pichai decides when to inspect the underlying details. Automation handles the reading queue; judgment remains with the executive.
Google Cloud is also bringing OpenAI’s latest AI models, including GPT 6.1 Astra, Sol, and Luna, to Google Cloud and Antigravity. The naming needs correction: there is no GPT-6.1 Luna or Astra; both are instead GPT 6, while GPT 6.1 Sol exists.
Agent Compute Engine is therefore not just a new place to run a model. It is a cloud design for persistent, interruptible software workers that need isolation when active and almost no resources when idle. The hard part of the agent era was never getting software to produce an answer. It was giving that software somewhere safe to act.
Based on
