Google gives every AI agent its own tiny computer with Agent Compute Engine
Google just solved agent security and scaling by giving every AI agent a hardware-isolated microVM that pauses and resumes in milliseconds.
Tools · Source: Google Cloud Blog
What happened
Google Cloud just launched Agent Compute Engine at AGNTCon and MCPCon. It is a purpose-built compute service that gives every AI agent its own hardware-isolated microVM. The service already powers Gemini for work tasks and hits customer preview in the coming months.
The architecture physically splits the agent into two distinct parts. The harness acts as the brain and calls the model. The sandbox acts as the hands to run code, execute shell commands, and drive browsers. Each sandbox gets its own guest kernel and root access but holds absolutely zero backend credentials.
Google also dropped Agent Substrate. This is an open-source sibling built for Kubernetes. It is available now on Google Kubernetes Engine for non-production use. Substrate hit 500 activations per second with under 500 milliseconds of suspend and resume latency in a massive 200,000-agent benchmark.
Key facts
- 500 ms — Suspend and resume latency benchmarked by Agent Substrate
- 10x — Higher compute density compared to traditional compute
- 200,000 — Number of agents run in the benchmark validation
- 1,000 — Dormant agents per host supported by Agent Substrate
Why it matters
Running autonomous agents at scale is a brutal infrastructure challenge. Agents spend the vast majority of their time just waiting. They wait on language models to generate tokens or humans to approve actions. Traditional compute primitives charge you for all that idle time. Google solves this by checkpointing idle microVMs to zero active resources. When the agent finally needs to act, the system resumes it from a snapshot almost instantly. This fundamentally changes the unit economics of running agentic workflows.
The security model is the second massive shift. Prompt injection is a reality we have to live with. If an attacker hijacks an agent inside this new sandbox, they find absolutely nothing to steal. All real credentials get injected in flight outside the microVM by an Agent Gateway. The sandbox only gets a short-lived identity token. This zero-trust approach removes the biggest compliance blocker for enterprise agent adoption.
For builders
Massive cost savings on idle agent compute
You no longer pay for active CPU while your agent waits for a language model response. Google uses copy-on-write memory sharing to pack over 1,000 dormant agents onto a single host. Builders get up to 10x higher compute density compared to traditional virtual machine setups.
Bulletproof security for untrusted code execution
You can safely let agents run untrusted code or browse the open web. The sandbox has no standard network interface and no direct virtual private cloud access. Enterprise security teams will actually approve your agent deployments because the blast radius is strictly contained.
Open-source portability with Agent Substrate
You do not have to wait for the managed service preview to start building today. Agent Substrate runs on any Kubernetes cluster and works with popular frameworks like Claude Code and Hermes. Platform teams can customize the runtime while keeping the same hardware isolation.
My take
We finally have infrastructure built for how agents actually operate. Giving every agent a disposable, credential-free microVM is the only sane way to scale autonomous systems in production. Google just made every existing agent hosting solution look like a legacy toy.
Original reporting: Google Cloud Blog. This is my rewrite and opinion.