Google Cloud Unveils Agent Compute Engine

Google Cloud announced Agent Compute Engine at AGNTCon and MCPCon on the 22nd, local time. The service gives each AI agent an independent virtual execution environment. It already runs Gemini for work agents, and Google plans to offer a customer preview in the coming months. The service assigns each agent session a hardware-isolated microVM (a small virtual machine with its own operating system) to manage security risks when running code, controlling browsers, and automating enterprise tasks.

Google said agents need infrastructure that can quickly create execution environments, safely isolate tasks, and suspend and resume work as agents write and run code, control tools and browsers, and repeat multi-step tasks. Each microVM has its own guest kernel and root access, and is separated from other environments by a cloud hypervisor (software that manages and isolates virtual machines). The system uses Google’s Titanium security architecture and infrastructure processing units. External proxies and policy checks protect internal secrets and systems from threats such as prompt injection (malicious instructions designed to manipulate an AI system).

The harness that handles model calls and task instructions runs outside the sandbox. Only required commands are passed into code, shell, and browser environments. When an agent finishes using its tools and waits, its microVM is saved as a checkpoint and made idle; a snapshot restores the environment when work resumes. Agents using the same operating system template can share memory through copy-on-write. Each microVM also connects to Hyperdisk, a persistent disk service, to retain task context.

Google also offers Agent Substrate, an open-source runtime for managing agents on Kubernetes. It integrates with agent frameworks including Claude Code, OpenClaw, and Hermes, and isolates each agent’s environment with a microVM or gVisor sandbox. In Google’s benchmark, the system handled 500 activations per second across 200,000 agents, with suspension and resumption taking under 500 milliseconds. Google said it achieved up to 10 times the computing density of existing approaches.

Google is expanding governance features for managing enterprise agents, including an agent gateway, registry, identity, and observability. The features are intended to control misuse of permissions and data leaks when agents access multiple models and tools, and to support token usage management and model routing. Google is also pursuing integrations with external identity services including Ping Identity, SailPoint, and Saviynt. The company said safely running autonomous agents is an infrastructure challenge and that large-scale sessions require new approaches to execution and control.

Google Cloud announced Agent Compute Engine at AGNTCon and MCPCon on the 22nd, local time. The service gives each AI agent an independent virtual execution environment. It already runs Gemini for work agents, and Google plans to offer a customer preview in the coming months. The service assigns each agent session a hardware-isolated microVM (a small virtual machine with its own operating system) to manage security risks when running code, controlling browsers, and automating enterprise tasks.

Google said agents need infrastructure that can quickly create execution environments, safely isolate tasks, and suspend and resume work as agents write and run code, control tools and browsers, and repeat multi-step tasks. Each microVM has its own guest kernel and root access, and is separated from other environments by a cloud hypervisor (software that manages and isolates virtual machines). The system uses Google’s Titanium security architecture and infrastructure processing units. External proxies and policy checks protect internal secrets and systems from threats such as prompt injection (malicious instructions designed to manipulate an AI system).

The harness that handles model calls and task instructions runs outside the sandbox. Only required commands are passed into code, shell, and browser environments. When an agent finishes using its tools and waits, its microVM is saved as a checkpoint and made idle; a snapshot restores the environment when work resumes. Agents using the same operating system template can share memory through copy-on-write. Each microVM also connects to Hyperdisk, a persistent disk service, to retain task context.

Google also offers Agent Substrate, an open-source runtime for managing agents on Kubernetes. It integrates with agent frameworks including Claude Code, OpenClaw, and Hermes, and isolates each agent’s environment with a microVM or gVisor sandbox. In Google’s benchmark, the system handled 500 activations per second across 200,000 agents, with suspension and resumption taking under 500 milliseconds. Google said it achieved up to 10 times the computing density of existing approaches.

Google is expanding governance features for managing enterprise agents, including an agent gateway, registry, identity, and observability. The features are intended to control misuse of permissions and data leaks when agents access multiple models and tools, and to support token usage management and model routing. Google is also pursuing integrations with external identity services including Ping Identity, SailPoint, and Saviynt. The company said safely running autonomous agents is an infrastructure challenge and that large-scale sessions require new approaches to execution and control.