Google isolates every Gemini agent

A new room for every agent

Google Cloud’s latest AI infrastructure move is not another model launch. It is a new place for agents to live. On October 22, Google introduced Agent Compute Engine, a service designed to give every Gemini agent its own high-performance, secure computer rather than forcing autonomous workloads to share a loosely isolated execution layer [1]. The technical phrase is a hardware-isolated microVM, but the strategic idea is simpler: if agents are going to browse, run code, call tools, handle enterprise data and keep working between user interactions, they need a controlled room of their own.

That matters because agentic AI changes the risk profile of cloud computing. A chatbot produces text. An agent can take actions. It can execute shell commands, operate a browser, install libraries, query internal systems and act on a user’s behalf. Google’s deep dive describes this as a split between the agent “brain,” which decides what to do, and the sandbox “hands,” which execute code, browser actions and tool calls [2]. Agent Compute Engine is aimed squarely at securing those hands.

Why microVMs, not just containers?

Google’s pitch begins with a trade-off that cloud teams know well. Traditional virtual machines provide strong boundaries, but they are heavy to start, suspend and resume. Containers are fast and dense, but they share the host kernel, which may be uncomfortable when the workload is an autonomous agent that needs root-level control, language runtimes, browsers and network tools [2]. Agent Compute Engine tries to combine both sides: microVMs that retain VM-like isolation while approaching container-like speed and density [1].

The company says each Agent Compute Engine environment runs behind a hardware-isolated Cloud Hypervisor boundary with its own guest kernel and root access [1]. Google also says every microVM gets a cryptographically verified identity, while service credentials are injected outside the microVM through the egress path rather than being stored inside the sandbox [1]. In other words, the agent can act, but the sandbox should not become a vault full of reusable secrets.

SiliconANGLE framed the same point through the language of blast radius. If a malicious prompt, bad code path or compromised tool takes over one sandbox, Google’s design is meant to prevent that compromise from spreading into other agents’ environments or exposing credentials held elsewhere [3]. This is the core enterprise promise: isolate execution, externalize secrets, and mediate traffic.

The security model: zero secrets inside the room

The most important design choice is that the agent’s workspace is not supposed to contain long-lived credentials. Google’s technical post says guest environments hold no persistent secrets, OAuth refresh tokens or cloud service account keys in memory or on disk [2]. Instead, each microVM receives short-lived identity material, while long-lived credentials remain off-host and are swapped in by Agent Gateway only after identity and policy checks [2].

That distinction is crucial. Enterprise agents need to read documents, query databases and call services. But if the agent’s execution environment contains standing credentials, a prompt-injection attack can become an identity breach. Google’s architecture tries to move the sensitive part of authorization outside the agent’s reach. The microVM can request access; Agent Gateway decides whether the request matches the user delegation, the agent identity and the network policy [2].

Networking follows the same pattern. Google says microVMs do not get ordinary virtual network interfaces, default IP gateways or direct VPC access; inbound and outbound traffic must cross an isolated point-to-point boundary and pass through mediation proxies and an external gateway that validates scopes and enforces outbound policy [2]. For regulated customers, this is likely the feature that matters more than the phrase “microVM.” The governance surface is outside the sandbox.

Persistence without a permanent mess

Agents also need memory in the practical infrastructure sense. If an agent installs Python packages, writes scripts, edits files or generates charts, the next step should not require rebuilding the whole environment. Google says each Agent Compute Engine microVM can have its own Hyperdisk-backed persistent workspace for files and agent context [1]. The deep dive separates agent data into ephemeral scratch space, shared read-only volumes and persistent user workspaces, with the durable state preserved while common components such as base images and package caches can be shared [2].

This is one reason Google is not simply treating agents as short-lived functions. The company describes agent workloads that may last across turns, days or long software-engineering tasks [2]. Agent Compute Engine is designed so an agent can stop actively consuming compute, preserve its state, and resume when a human, model or external system needs the next action [1].

The scale trick: pause the idle agent

The economic problem is that agents wait a lot. They wait for models, users, tools, approvals and external systems. If every waiting agent consumed a full active VM, the cost curve would be ugly. Google says Agent Compute Engine handles this by checkpointing idle microVMs and restoring them quickly when needed [1]. Its related open-source Agent Substrate runtime on Google Kubernetes Engine snapshots active memory when an agent becomes idle and returns the machine to the pool [1].

Google claims Agent Substrate can deliver up to 10 times higher compute density than traditional compute while preserving kernel isolation and identity-based network security for every agent [1]. It also says benchmark validation with 200,000 agents sustained 500 activations per second at under 500 milliseconds of suspend-and-resume latency [1]. The Decoder reported the same 200,000-agent figure and noted that idle VMs pause automatically to free machines for other workloads [4].

These are vendor claims, not independent benchmarks. But they explain why this launch is bigger than a security wrapper. Google is trying to make per-agent isolation economically plausible. Without that efficiency layer, “one agent, one VM” would sound safe but expensive.

Cloud, hybrid and on-premises implications

Google is also positioning the runtime as part of a broader governance fabric. The company says Gemini for business agent governance is expanding across Google Cloud runtimes, cross-cloud environments, on-premises systems and managed client devices [1]. For teams already standardized on Kubernetes, Agent Substrate is open source, Kubernetes-native and designed to run in any compute environment, including alongside existing workloads [1].

That matters for regulated enterprises because their data is rarely in one clean cloud location. Google’s deep dive says business customers want agents to use Workspace data, private VPC databases and internal MCP servers without moving sensitive data to another vendor or opening firewall ports for the agent [2]. The answer Google presents is policy-driven reachability through Agent Gateway, Private Service Connect and VPC Service Controls, with audit logs and credentials kept out of the sandbox [2].

What is shipping now, and what is not

The announcement is still partly forward-looking. Google says Agent Compute Engine is targeted for preview in the coming months, and the company is asking interested users to register rather than presenting it as a generally available service [2]. Google is also adding Agent Gateway capabilities this quarter in preview, including granular token and cost governance, model routing, service extensions, and delegated authorization support with identity partners such as Ping Identity, SailPoint and Saviynt [1].

So the current state is clear: Google has disclosed the architecture, tied it to Gemini’s own agent workloads, described the governance model, and pointed developers toward a forthcoming preview [1]. What customers do not yet have is public pricing, broad availability, or independent performance validation.

The competitive meaning

Agent Compute Engine signals where enterprise AI infrastructure is heading. The competition is no longer only about which model answers best. It is about which cloud can provide a safe, observable and cost-controlled execution layer for agents that act continuously. Google’s bet is that every serious agent will need a room, an identity, a policy boundary, persistent storage and a way to sleep cheaply.

If that bet is right, microVM isolation becomes a product primitive for AI platforms. The agent is not just a prompt. It is a running computer with permissions. Google has now made that computer the center of its Gemini agent infrastructure story.

Sources from the last 72 hours

1. [1]Introducing Agent Compute Engine and expanding agent governanceOct 22, 2026, 2:00 AM
2. [2]Inside Agent Compute Engine: Building the compute foundation for the agentic eraOct 22, 2026, 2:00 AM
3. [3]Google Cloud introduces Agent Compute Engine to host AI agentsOct 23, 2026, 2:11 AM
4. [4]Google's Agent Compute Engine gives every Gemini agent its own hardware-isolated micro virtual machineOct 22, 2026, 2:00 AM

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.