Google Cloud launches Agent Compute Engine: one hardware-isolated microVM per AI agent, 200,000-agent benchmark at 500 activations per second

Pin the source first. The primary material is a Google Cloud blog post published October 22, 2026 titled Introducing Agent Compute Engine and expanded agent governance, written by Nirav Mehta, Michael Bachman and Kevin Hutchins, and released at AGNTCon + MCPCon. Every number and quote below comes from that post; secondary rewrites were not used.

What shipped. Google Cloud launched Agent Compute Engine, a purpose-built compute service for agents that the company says already powers Gemini as an agent for work tasks; customer preview arrives in the coming months with hardware-isolated runtime sandbox security. At the same time Google extended agent governance for Gemini for business so it covers agents wherever they operate. Read together, the message is that compute and governance arrive as one package rather than governance trailing behind.

Why existing compute does not fit. The blog puts it plainly: agents start, pause and resume constantly, which needs an architecture that stays fast at scale while being extremely efficient, whereas traditional compute primitives were optimised for standard workloads and not for the highly iterative rhythm of AI agents. That sentence is the most valuable judgement in the post, because it means an enterprise fluent in Kubernetes will still run into the particular shape of the agent lifecycle.

How the savings work. Three things stack. First, microVMs boot rapidly so an agent loop or an eval sweep never waits on infrastructure. Second, copy-on-write memory sharing runs multiple agents on a single operating system template, getting the most out of each physical machine. Third, idle microVMs are paused through fast checkpoint and restore. The post describes one detail worth noting: when an agent finishes a tool call and enters the thinking phase of the loop, the microVM signals that it is idle and the host moves it from an active to an idle state. In other words, while an agent waits on a human or an external system, the machine can be suspended and later resumed from a snapshot.

How security is delivered. Google states that untrusted or adversarial code executing inside a sandbox is an ever-present reality as agents take on harder tasks, so Agent Compute Engine runs on Google's offload IPU for silicon-rooted defense in depth. Isolation comes from a hardware-isolated Cloud Hypervisor boundary, and each microVM carries its own guest kernel and root access. Each microVM runs with the identity of its agent using short-lived credentials, gets a cryptographically verified ID, and has service credentials injected on the egress path outside the microVM rather than inside the sandbox. Integration with Agent Gateway pulls observability, policy and security evaluation together.

Persistence and not moving data. Because agents need data to persist across multiple long-running sessions, every microVM has its own storage for execution workspaces and agent context. The other half matters more: agents doing meaningful work need enterprise data without moving it, so Agent Compute Engine is woven directly into Google's cloud and identity fabric, with enterprise connectivity governed by the same security and identity model that protects the microVM. That yields a unified identity model and auditability, which for anyone doing enterprise integration matters more than any benchmark.

One quote deserves to be copied out. Gautham Thambidorai, VP and Google Fellow for Gemini, said: Scaling the Gemini agent to planet scale requires compute that spins up rapidly and operates with extreme efficiency. Agent Compute Engine microVMs give us the responsiveness, hardware isolation, and workload density needed to deliver interactive agent sandboxes to our users around the world. Note the three words, responsiveness, isolation and density, which is exactly the combination neither traditional VMs nor enterprise containers delivered together.

Do not skip the open-source track. For platform teams that want customisation, multi-cloud portability or have already standardised on Kubernetes, Google offers Agent Substrate, an open-source execution runtime that brings the same agent-first design to GKE with a zero-trust architecture that decouples agent execution from machine management. When an agent goes idle, Agent Substrate snapshots its active memory and returns the machine to the pool, resuming the agent the moment it is needed. Two numbers stand out: as much as 10x higher compute density than traditional compute, and in benchmark validation running 200,000 agents, 500 activations per second at under 500 milliseconds suspend and resume latency. Each sandbox can use microVM or gVisor, every agent gets a cryptographically secure identity, and egress proxies enforce granular network policies and inject credentials outside the sandbox.

Governance is the part people skim past. Google says it extended Gemini for business agent governance to support agents wherever they operate, bundled with the compute service. In plain terms: the old worry was that an agent runs and nobody governs it, so governance now sits at the runtime layer, with identity, credentials, policy and observability attached uniformly outside the sandbox. For security teams this moves the governance point from application code into infrastructure, and the review target moves with it.

Where the boundaries are. First, Agent Compute Engine is a preview due in the coming months, not a generally available enterprise product, and Google published neither SLAs nor a region list. Second, the 10x density and 500 activations per second are official Agent Substrate benchmarks measured in a 200,000-agent validation scenario, which is not your workload. Third, no pricing was disclosed, so any claim about how much money this saves has no basis yet. Fourth, this article records only what was officially published through October 26, 2026, and does not forecast a GA date.