Google makes Gemini agent infrastructure available as cloud service

Agent Compute Engine to launch in preview, offering secure microVM sandboxes for AI agents

By LineZotpaper

Published22 October 2026

Read Time3 min

Google announced on Thursday at the Linux Foundation's AGNTCon+MCPCon in San Jose that it will offer Agent Compute Engine, the infrastructure used to power Gemini and other internal agentic workloads, as a cloud service preview later this year. The service gives each AI agent its own persistent, sandboxed microVM with isolated compute and memory, combining the speed of containers with the security of a sandbox.

The announcement at AGNTCon+MCPCon marks Google's move to productise the infrastructure behind its own autonomous agents. According to Google distinguished engineers Rohit Jnagal and Ramanathan Venkatapathy, agentic workloads have quickly become one of the fastest-growing consumers of compute and storage across Google's fleet, spurring the need for a purpose-built compute service.

Agent Compute Engine provides each agent session with a single-tenant, memory-safe microVM running on Cloud Hypervisor, an open source virtual machine monitor. The environments hold no secrets in memory or on disk, have only a short-lived, session-scoped identity delivered through a local listener, and run all traffic through a proxy outside the sandbox. Snapshots and disks are end-to-end encrypted in transit and encrypted at rest. The underlying host has a read-only filesystem and cryptographically verified hardware and firmware.

The design assumes an attacker controls everything inside the sandbox, so there is nothing to steal. Agents can work with shell scripts, use a headless browser, and write code with root permissions in loops that may run for weeks. When an agent waits on a model or tool call, the host checkpoints its microVM, consuming no active resources until the next call arrives.

Google is not alone in the agent sandbox market. Startups like E2B and Daytona offer similar microVM-based sandboxes on any cloud, and Amazon Web Services provides Bedrock AgentCore with its own microVM isolation. E2B runs each sandbox in a Firecracker microVM and can pause and resume in about a second. Daytona added microVM sandboxes in July that can pause a full machine or fork running copies. AWS's AgentCore does not charge for CPU while an agent waits but continues billing memory, with sessions up to eight hours or up to 14 days on EC2-based instances.

Alongside the cloud service, Google unveiled Agent Substrate, an open source runtime for Google Kubernetes Engine announced in May. Substrate snapshots idle agent memory and returns the machine to the pool, achieving up to ten times the density of traditional compute, according to Google. In a benchmark of 200,000 agents, it handled 500 activations per second with suspend and resume in under half a second. Substrate works with any Kubernetes cluster and supports harnesses including Claude Code, OpenClaw, and Nous Research's Hermes Enterprise. Nous Research chief business officer Hervé Bizira said in the announcement: 'We built Hermes Enterprise to enable customers to deploy into their existing infrastructure, while handling per-agent isolation and extensible access control. Agent Substrate addresses both at the platform layer in a way that also preserves valuable compute resources.'

Analysis

Why This Matters

AI agents are an emerging computing paradigm; secure runtime environments are essential for safety and reliability.
By offering its internal infrastructure as a service, Google lowers the barrier for enterprises to deploy autonomous agents.
The platform's design (checkpointing, encrypted snapshots) could become the de facto security model for agent sandboxes.

Background

Traditional virtual machines are too slow for agent boot cycles; containers lack isolation. Google, like AWS and others, has developed microVM technology that can suspend and resume almost instantly while providing strong isolation. Google's Agent Compute Engine evolved from internal tools for Gemini, Antigravity, and model training. It follows the pattern of Google turning internal infrastructure into products, as it did with Borg later inspiring Kubernetes.

Key Perspectives

Google: By opening its agent runtime, Google aims to capture the growing agent-as-a-service market, leveraging its scale and security expertise. AWS and competitors: They already offer similar sandbox services; Google's entry may intensify competition and standardisation. Developers and enterprises: They gain more choice in trusted agent infrastructure, but may face lock-in or complexity.

What to Watch

Performance benchmarks and pricing versus AWS Bedrock AgentCore and startups like E2B.
Adoption of open source Agent Substrate across Kubernetes clusters.
How Google's experience with agent workloads at massive scale translates into reliability and cost advantages.

Sources

Google turns the infrastructure behind Gemini’s agents into a cloud service · The New Stack

Checked

12 claims in this story checked against 1 source: 7 supported.

Show each claim

Partly supportedGoogle has made Gemini agent infrastructure available as a cloud service.The New Stack: “Agent Compute Engine will become available in preview to Google Cloud users later this year.”
SupportedAgent Compute Engine will launch in preview with microVM sandboxes for AI agents.The New Stack: “Agent Compute Engine will become available in preview to Google Cloud users later this year. It will provide every AI agent with a hardware-isolated microVM that combines the speed of containers with the security of a sandbox.”
SupportedGoogle announced Agent Compute Engine on Thursday at the Linux Foundation's AGNTCon+MCPCon in San Jose.The New Stack: “Announced on Thursday at the Linux Foundation’s AGNTCon+MCPCon in San Jose, Agent Compute Engine will become available in preview to Google Cloud users later this year.”
Partly supportedAgentic workloads are one of the fastest-growing consumers of compute and storage across Google's fleet, according to Rohit Jnagal and Ramanathan Venkatapathy.The New Stack: “According to the company, agentic workloads have quickly become one of the fastest-growing consumers of compute and storage across its fleet.”
Partly supportedSnapshots and disks are end-to-end encrypted in transit as well as encrypted at rest.The New Stack: “All traffic is end-to-end encrypted in transit, and snapshots and disks are encrypted at rest.”
Partly supportedThe host checkpoints an agent's microVM when the agent is waiting on a model or tool call.The New Stack: “Agents spend most of their time waiting on the model or the user. So once an agent finishes a tool call, the host checkpoints its microVM”
SupportedAgents can write code with root permissions in loops that may run for weeks.The New Stack: “That allows the agents to work with shell scripts, use a headless browser, and write code (with root permissions to that machine) in agent loops that could run for weeks.”
SupportedAWS AgentCore does not charge for CPU while an agent waits but continues billing memory; sessions can last up to eight hours or up to 14 days on EC2-based instances.The New Stack: “AWS doesn’t charge for CPU while an agent waits on a model or tool call, though memory keeps billing until the runtime reclaims it. Those sessions top out at eight hours. In August, AWS added EC2-based runtime instances that can keep shared sessions alive for up to 14 days.”
SupportedAgent Substrate can achieve up to ten times the density of traditional compute, according to Google.The New Stack: “Google says that means up to 10 times the density of traditional compute.”
SupportedIn a benchmark of 200,000 agents, Agent Substrate handled 500 activations per second with suspend and resume in under half a second.The New Stack: “In a 200,000-agent benchmark, Substrate handled 500 activations per second, with agents suspending and resuming in under half a second, the company says.”
Partly supportedAgent Substrate supports Nous Research's Hermes Enterprise as a harness.The New Stack: “Substrate runs on any Kubernetes cluster, and Google says it works with any harness, including Claude Code, OpenClaw, and Nous Research’s Hermes.”
SupportedHervé Bizira said: 'We built Hermes Enterprise to enable customers to deploy into their existing infrastructure, while handling per-agent isolation and extensible access control. Agent Substrate addresses both at the platform layer in a way that also preserves valuable compute resources.'The New Stack: ““We built Hermes Enterprise to enable customers to deploy into their existing infrastructure, while handling per-agent isolation and extensible access control,” Hervé Bizira, Nous Research’s chief business officer, notes in the announcement. “Agent Substrate addresses both at the platform layer in a way that also preserves valuable compute resources.””