Google Cloud has unveiled a new way to run AI agents: give every agent its own computer. Announced on October 22 at AGNTCon + MCPCon in San Jose, Agent Compute Engine assigns each agent session a hardware-isolated microVM, with its own guest kernel, root access and Hyperdisk storage.
The design splits an agent into two parts. The harness, or “brain,” calls the model and issues commands. The sandbox, or “hands,” runs code, shell commands and browser actions inside the microVM, with the harness kept entirely outside that boundary. The service already powers Gemini as an agent for work tasks, along with Antigravity and internal evaluation pipelines.
The headline security feature is what the sandbox does not contain: credentials. The microVM holds no API keys or service tokens. Outbound requests pass through a local proxy to an external Agent Gateway, which swaps in the real backend credential only after policy checks. Google assumes an attacker controls everything inside the sandbox — a prompt-injected agent finds no secrets to steal.
Idle agents are also handled efficiently. When a tool call finishes and the agent waits, the host checkpoints the microVM to zero active resources and resumes it from a snapshot when work returns. An open-source sibling, Agent Substrate, brings the same architecture to any Kubernetes cluster and, in a 200,000-agent benchmark, sustained 500 activations per second with under 500 ms suspend and resume latency.
Customer preview of Agent Compute Engine is expected in the coming months. Google has not yet published pricing, boot times or density figures for the service itself, but the direction is unmistakable: as agents gain real permissions, isolation is becoming the product. Developers building with tools like Claude Code and Cursor should watch this space closely.
Source: MarkTechPost
