Google is bringing Agent Compute Engine to Google Cloud, a service that gives every AI agent its own hardware-isolated microVM. A preview is planned for the coming months.
Google first built Agent Compute Engine for its own use. The platform currently runs the agents of Gemini, the Gemini platform and Antigravity, as well as the pipelines Google uses to evaluate and train its models with reinforcement learning. Now the service is also coming to Google Cloud customers. Interested parties can already sign up for the preview.
Agent Compute Engine
Each agent session runs in its own single-tenant microVM. Google assumes that an attacker controls everything in the sandbox, for example through a malicious email that the agent reads. The microVM therefore contains no user credentials, API keys or OAuth tokens, and has no regular network interface.
All traffic from the sandbox goes through a proxy to Agent Gateway. That gateway verifies the identity of the user, the agent and the node, applies the egress policy and only then adds the credential the backend needs. An administrator defines which VPC networks, Workspace APIs and external domains an agent may access.
Waiting agents
According to Google, agents spend most of their time waiting for the model or the user. As soon as an agent stops executing tasks, the platform suspends the sandbox using a checkpoint. Files and memory are preserved, so the agent can resume immediately on the next task. On a single host, all microVMs also share the same in-memory copy of the base operating system, libraries and binaries.
An environment can also be snapshotted once and then forked into thousands of parallel copies, for evaluations and reinforcement learning. Clement Farabet, VP at Google DeepMind, uses these features for Antigravity. “Autonomous coding agents need real computers, with root access, their own compilers, test runners and persistent git workspaces, and they must be able to branch into parallel experiments in an instant.”
Preview in the coming months
With Agent Compute Engine, developers determine the image, identity, network access and lifecycle of each environment themselves. Google manages the underlying infrastructure and capacity. The preview is planned