Google Cloud has introduced Agent Compute Engine, a service designed to run AI agents in isolated micro virtual machines. It is intended for workloads used by Gemini, internal software teams and enterprise customers.
The launch is Google Cloud's latest effort to adapt its infrastructure for a new class of AI software that can take actions on behalf of users rather than simply generate responses. These workloads have become one of the fastest-growing consumers of compute and storage across its systems.
Agent Compute Engine gives each AI agent its own hardware-isolated microVM while keeping credentials outside the sandbox where the agent runs. Google Cloud says this is intended to combine the separation associated with virtual machines with the speed and density more commonly linked to containers.
The service is used across four broad categories inside Google: consumer and enterprise agent tools, software engineering workspaces, large-scale model evaluation and reinforcement learning, and sandbox environments for internal services that need to run dynamic logic.
Google's description of the product reflects a wider challenge facing cloud providers and AI companies as they move from chatbots to software agents. These systems often need access to files, browsers, code runtimes and networks, but they also create new security and cost issues when millions of sessions must remain available even while inactive.
According to Google Cloud, traditional virtual machines offer isolation but can take seconds or minutes to start, suspend or resume. Containers are faster, but may not provide the same level of separation for workloads that require deeper control of the environment. AI agents also often spend much of their time waiting between model steps or user instructions, making permanently active virtual machines expensive and inefficient.
Security model
A central part of the system is a design that assumes code inside the sandbox may be untrusted. The microVMs hold no persistent secrets, OAuth refresh tokens or cloud service account keys, and they do not have access to a cloud instance metadata server.
Instead, outbound requests are routed through local and external proxies, with identities and credentials managed off the node. When an agent requests access to a document or private resource, the request is checked outside the sandbox before the appropriate credential is applied.
The platform also uses Google's Titan and Titanium infrastructure components as part of its trust model. Private keys for node and workload attestation are kept outside the guest environment, while storage attachments are mediated by the infrastructure processing unit.
Another element is the separation between the orchestration layer, described as the agent's brain, and the sandbox where code and commands are executed. Google Cloud says that boundary creates an audit trail linking tool calls initiated by the harness to activity inside the execution environment.
Cost and scale
Google Cloud says one of its main findings from operating agents is that most sessions are idle most of the time. Agent Compute Engine uses what Google calls application-aware idle detection so a sandbox can signal when it has finished a task and entered a waiting state.
At that point, the host can checkpoint the sandbox and preserve its state while reducing active resource use. This, Google Cloud says, allows a single physical node to host far more agent sessions than a conventional virtual machine approach.
The system also uses pre-warmed snapshot images and deduplicated memory. Where many agents run the same base image, runtime or browser, the host keeps a single copy of shared static pages in physical memory and allocates additional memory only for data each agent changes.
Storage is also divided into layers. Temporary operating system data is handled through disposable overlays, shared read-only volumes are used for common files such as toolchains and package caches, and only a user's working state and saved outputs are stored durably.
Enterprise access
For business users, the service is designed to let agents work with data in Google Workspace, private virtual private cloud networks and internal model context protocol servers without moving sensitive information to external systems or opening direct firewall access.
Administrators can define which resources an agent may reach, and all requests are checked through policy controls and identity verification before access is granted. Google Cloud says the model is intended to provide auditability for actions taken by agents on behalf of users.
"Scaling the Gemini agent to planet scale requires compute that spins up rapidly and operates with extreme efficiency. Agent Compute Engine microVMs give us the responsiveness, hardware isolation, and workload density needed to deliver interactive agent sandboxes to our users around the world," said Gautham Thambidorai, VP & Google Fellow, Gemini.
Google also pointed to software engineering use cases where agents need persistent Linux environments, compilers, test tools and the ability to branch tasks quickly. That reflects growing demand for coding assistants that can do more than suggest snippets and instead carry out multi-step development work over extended periods.
"Autonomous coding agents need real computers - complete with root privileges, custom compilers, test runners, and persistent git workspaces - and they need to branch into parallel experiments in the blink of an eye. Agent Compute Engine gives Antigravity the instant snapshot-and-fork primitives and rapid resume speeds that make long-horizon software engineering feel effortless," said Clement Farabet, VP, Google DeepMind.