Google Agent Compute Engine: microVM isolation, zero credentials

Google Cloud announced Agent Compute Engine at AGNTCon + MCPCon, a compute service built specifically for AI agents. Each agent runs inside its own hardware-isolated microVM with a dedicated guest kernel, root access and persistent storage on Hyperdisk. The service already powers Gemini for work tasks. Customer preview is targeted for the coming months, though exact launch timing and pricing have not been disclosed.

The core innovation centers on a split architecture: the harness, or brain, runs fully outside the sandbox and calls the language model. The sandbox, or hands, runs inside the microVM and executes code, shell commands and browser automation. The sandbox itself holds zero credentials.

What changed

Hosts run on Google-managed appliances using Titan silicon and the Titanium IPU. Each host is stateless, with a read-only root filesystem enforced by dm-verity. All traffic from the sandbox crosses a virtio-vsock boundary to a local proxy, then to an external gateway. There is no standard network interface, default gateway or direct VPC access inside the guest. The isolation boundary is the Cloud Hypervisor.

The credential swap happens off-node. Guests receive only a session-scoped SPIFFE certificate and a short-lived identity token. Agent Gateway translates this workload identity into the real backend credential after verifying host, user, sandbox, session and policy. If an attacker gains control of the sandbox through prompt injection or code execution, they find no secrets to steal.

Google also introduced Agent Substrate, an open-source, Kubernetes-native counterpart available on GKE since September 15. It offers Cloud Hypervisor microVMs or gVisor sandboxes. The company reports that Agent Substrate achieved 500 activations per second at under 500 milliseconds suspend/resume latency across a 200,000-agent benchmark, with over 1,000 dormant agents per host. It supports harnesses including Claude Code, OpenClaw and Hermes. Agent Substrate source code is published on GitHub and open to all GKE customers for non-production use. Production GA remains allowlist-only.

Why it matters

Most AI agents spend the majority of their time waiting on model responses or user input. Google addressed this by checkpointing idle microVMs to zero active resources. When a tool call completes, the sandbox signals the host. The microVM suspends and resumes from a snapshot on the next call. This idle economics model depends on copy-on-write memory sharing. Pre-warmed snapshot images are mapped with DAX, so multiple microVMs on a single host can share base OS and library pages. Only each agent’s modified pages consume private memory.

For enterprises running multi-agent systems, this architecture addresses three security concerns. First, the sandbox has no ambient access to credentials or network resources. Second, every identity is scoped to a specific session and validated off-node. Third, the host is stateless and attestable. The design assumes an attacker controls everything inside the sandbox.

The four-identity model clarifies credential scope and isolation. User identity authenticates the overall task only. Delegated on-behalf-of identity is a scoped grant stored in a central authorization service, never on the compute node. Agent Workload Identity is a short-lived SPIFFE certificate assigned when the microVM spins up, identifying which sandbox sent a packet. Agent Workforce Identity lets an agent act as an assistant with its own account and resources. If the workload identity is exfiltrated, it is useless for direct API calls and only identifies which sandbox originated the traffic.

Google is expanding agent governance across its stack. New capabilities arriving in preview include Envoy-based enforcement points for multicloud and hybrid setups, governance for local coding agents like Claude Code and Antigravity CLI on managed devices, token management, model routing, Service Extensions bindings and Express Link for Cloud Run.

What to test

Before adopting Agent Compute Engine, teams should verify several assumptions through pilot deployments:

• Does checkpointing to zero active resources actually reduce idle costs at scale? Google discloses no per-host density figure for Agent Compute Engine itself, only Agent Substrate benchmarks. Test real workload patterns to confirm savings.
• How long does resume latency remain under 500 milliseconds at your typical session volume and data size? Agent Substrate hit this target; Agent Compute Engine figures are not published.
• Does the off-node credential swap introduce unacceptable latency for high-frequency tool calls? Test with your model and backend combination.
• Does the sandbox isolation break any required integrations? Verify that your agents can still reach necessary APIs and data stores through the proxy and gateway.
• What happens at scale? The 200,000-agent benchmark is noteworthy, but test your own multi-tenant scenarios.
• How does boot time compare to alternatives? Google has not published boot figures for Agent Compute Engine.

Compare the isolation and cost model against alternatives like AWS AgentCore Runtime, Azure dynamic sessions and E2B. Each offers different trade-offs in session timeout, persistence and credential handling.

Common questions

How is this different from standard Compute Engine?

Standard Compute Engine runs virtual machines with traditional networking, credential injection and resource billing. Agent Compute Engine is purpose-built for agents with VM-grade isolation, zero-credential sandboxes and checkpoint-based idle efficiency. Each agent gets its own microVM with a dedicated kernel and root access, which differs from container-based approaches.

What credentials are available inside the sandbox?

None. Guests receive only a short-lived SPIFFE workload identity that identifies the sandbox, not authenticates it for backend calls. Agent Gateway swaps this token for real credentials off-node after policy checks. If an agent is compromised, the attacker finds no credentials to exfiltrate.

Why does Agent Substrate show 500 activations per second but Agent Compute Engine numbers are not disclosed?

Agent Substrate is open-source and runs on GKE, where Google can publish benchmark data. Agent Compute Engine is a managed service in preview, and the company has not yet released performance figures or pricing. Expect disclosure closer to general availability.

Does idle checkpointing work for stateful agents?

Yes. The copy-on-write snapshot preserves the agent’s state, including modified memory pages. Only the base OS and library pages are shared across multiple dormant agents. When the microVM resumes, it restores the full state from the snapshot.

The conclusion

Agent Compute Engine addresses a real problem in enterprise agent deployment: how to run dozens or hundreds of agents on shared infrastructure without sacrificing isolation or inflating costs. The zero-credential sandbox and off-node credential swap are sound design decisions that shift the security boundary away from the agent itself.

The main weakness is visibility. Google has not published boot time, per-host density, pricing or an exact GA date for Agent Compute Engine. The Agent Substrate benchmarks (500 activations per second, under 500 milliseconds resume) give a reference point but not a ceiling for the managed service. Teams evaluating this should focus on pilot testing with real workloads before committing to large deployments.

Watch for three developments: first, GA timing and pricing; second, published density and latency figures for Agent Compute Engine under load; third, how the governance stack integrates across Cloud Run, GKE and hybrid environments. The infrastructure design itself is sound. The ecosystem integration will determine adoption.

Related reading

• Grok Voice 3.0 vs Voxtral 3: Voice Agent Comparison
• Agent Skills standard donated to Agentic AI Foundation
• Amazon Polly Generative engine: 14 new voices, Hindi and Finnish GA