Google Cloud Extends Agent Compute Engine MicroVMs to Enterprise Developers

Google Cloud is opening its Agent Compute Engine to external developers, providing a specialized infrastructure layer designed to handle the unique lifecycle requirements of AI agents. Announced on October 22, 2026, at the AGNTCon + MCPCon event in San Jose, this service provides hardware-isolated microVMs for individual agent sessions.

The architecture addresses the specific performance bottlenecks inherent in managing large-scale agent deployments. Google Distinguished Engineers Ramanathan Venkatapathy and Rohit Jnagal noted that traditional virtual machines often struggle with the frequent suspend and resume cycles required by agents, while standard containers lack the necessary kernel-level isolation.

Each microVM operates behind a hardware-isolated Cloud Hypervisor boundary, utilizing Google’s Titanium infrastructure processing unit to manage guest kernels. These environments lack standard virtual network interfaces or direct VPC access, forcing all traffic through a virtio-vsock channel to a local proxy.

This design ensures that long-lived user credentials remain off the host, with the Agent Gateway injecting identity tokens only after validating mTLS and egress policies. By isolating the network stack, the architecture prevents agents from accessing sensitive internal resources even if the agent runtime itself is compromised.

Security remains the primary driver for this isolation model, specifically regarding the threat of prompt injection or malicious code execution within an agent. By assuming an attacker controls the sandbox environment, Google engineers designed the system to ensure that no sensitive credentials exist within the guest memory space.

Agents receive only session-scoped SPIFFE certificates and short-lived identity tokens during their execution lifecycle. This granular identity management ensures that every action taken by an agent is authenticated against specific egress policies, limiting the blast radius of potential security incidents.

Resource efficiency is achieved through a checkpointing mechanism that triggers when an agent is idle or awaiting model inference. The system uses copy-on-write memory to allow multiple agents to share a single OS template, enabling high-density deployments for coding, evaluation, and reinforcement learning pipelines.

Google claims this approach delivers up to 10x higher compute density compared to traditional compute services. This density is critical for teams managing thousands of concurrent agents that spend the majority of their time waiting for model responses.

Benchmark results shared by the company indicate that the platform can sustain 500 activations per second across 200,000 agents. The system maintains suspend and resume latency consistently under 500 milliseconds, which is essential for maintaining responsiveness in interactive developer assistant tools.

This performance is intended to support various agent frameworks, including Claude Code, OpenClaw, and Hermes. By providing a consistent runtime environment for the harness that manages model calls, the platform simplifies the transition from development to production for complex agentic workflows.

The expansion of Agent Gateway, Agent Registry, and Agent Identity controls to runtimes like Cloud Run and GKE suggests a broader strategy to standardize agent governance. Google plans to introduce Envoy-based enforcement points for multicloud and hybrid environments in the coming months, alongside token budget management and model routing features.

Integration with Google Kubernetes Engine allows teams to utilize Agent Substrate, an open-source runtime that snapshots an idle agent’s memory and returns the underlying machine to the pool. This integration ensures that Kubernetes-native organizations can maintain their existing operational patterns while benefiting from the performance gains of the microVM architecture.

The shift toward per-agent virtualization reflects a growing industry trend focused on securing AI workloads against lateral movement and credential theft. Similar initiatives, such as the open-source Capsem project and AWS Bedrock AgentCore, indicate that infrastructure providers are moving away from shared-kernel models in favor of hardware-enforced boundaries for agentic workflows.

Enterprise teams should monitor the upcoming preview period to evaluate how these microVMs integrate with existing CI/CD pipelines and managed devices. The ability to snapshot and fork memory-deduplicated environments could significantly reduce the overhead for large-scale evaluation tasks as agent complexity continues to increase.