Google Cloud's Agent Compute Engine runs AI agents

With its October 22, 2026 announcement, Google Cloud gave AI agents a compute layer of their own. Agent Compute Engine wraps every agent in a dedicated microVM that boots fast, suspends itself when the agent has nothing to do, and shares memory with its neighbors instead of holding idle capacity. Google says the service already carries Gemini; a preview follows in the coming months.

A microVM, not a container

The pitch is that agents need both the density of containers and the blast radius of a virtual machine. Google's answer runs on stateless appliances with immutable file systems, uses a dedicated security chip to verify firmware integrity, and relies on CPUs that ship with side-channel mitigations.

Storage reachable from inside the sandbox is deliberately thin, so an attacker who lands in a compromised microVM should be unable to read or delete data. All traffic in either direction has to cross an isolated point-to-point boundary: a local unprivileged proxy, then an external gateway that validates each connection against policy. Idle sandboxes are detected and shut down rather than left billing.

Agent Compute Engine also exposes operations borrowed from virtualization rather than from agent frameworks: cloning, snapshot and fork, rewind and rollback. An agent that reasons itself into a dead end can be returned to an earlier state instead of restarted from scratch.

Credentials never enter the sandbox

Agent credentials are stored outside the agent environment entirely. Agent Gateway retrieves them and submits them on the agent's behalf, so a breached sandbox should yield no usable secrets. A new Gateway release ships alongside the engine and adds model routing, steering each request to the model that handles that step most efficiently.

The companion piece is token management, which governs token consumption across agents and models and attributes the spend back to whoever caused it. That matters for teams running dozens of agents at once, where runaway inference cost is the practical failure mode. Google describes the governance surface as extending across Cloud Run, GKE and local devices, with third-party authorization through Ping Identity and SailPoint.

Agent Substrate, and the numbers Google published

Underneath sits Agent Substrate, which Google positions as an open-source alternative to Kubernetes and credits with up to 10x compute density. One cited benchmark had 200,000 agents running concurrently at under 500 ms latency. Both figures come from Google's own account and have not been independently verified.

What is still missing

There is no pricing and no firm preview date. The two reports also disagree on the security silicon: the decoder calls it a Titanium chip, SiliconANGLE calls it a Titan security chip, and the available coverage does not settle which label is correct. Named behind the work are distinguished engineers Ramanathan Venkatapathy and Rohit Jnagal, plus vice presidents Nirav Mehta, Michael Bachman and Kevin Hutchins.