Google Gives Gemini AI Agents Their Own Isolated MicroVMs

Google has unveiled Agent Compute Engine, a new cloud infrastructure service that gives Gemini AI agents individual, hardware-isolated micro virtual machines. Announced on October 22, 2026, at AGNTCon + MCPCon, the technology already powers agent workloads inside Google. A customer preview is planned for the coming months.

Instead of treating AI agents simply as applications running inside conventional containers, Google’s architecture gives each agent execution session a separate virtualized environment with its own guest operating system kernel. The service combines isolation, persistent storage, controlled networking and fast checkpointing to support agents that execute code, use tools and operate across multiple sessions.

Google Agent Compute Engine: A Separate MicroVM for Each Agent

In its official announcement, Google describes Agent Compute Engine as a purpose-built execution platform for autonomous workloads that repeatedly start, pause and resume while performing tasks.

Traditional virtual machines offer strong operating-system isolation but introduce overhead when starting and managing large numbers of instances. Containers are lightweight because they share a host kernel, but that design introduces different isolation considerations when workloads execute untrusted code.

Google’s microVM approach aims to combine the isolation properties of virtual machines with the operational efficiency required for large fleets of AI agents.

Each agent execution environment runs behind a Cloud Hypervisor boundary and can have its own guest kernel and root access. Multiple microVMs can still share the resources of a physical server; one microVM per agent does not mean one dedicated physical machine per agent.

How Google Protects AI Agents From Untrusted Code

Security is central to the design because autonomous agents may execute generated code, inspect external documents or interact with websites containing untrusted instructions.

Google’s engineering deep dive explains that the architecture uses its Titan security hardware and Titanium Infrastructure Processing Unit to support hardware-rooted protections and isolation.

The company says sensitive credentials, including long-lived user tokens and cloud service account keys, are kept outside the agent sandbox. Instead, microVMs receive short-lived identities, while an external gateway evaluates requests and supplies authorized credentials when required.

The microVMs also lack conventional direct network access. Communication passes through mediated interfaces and external policy enforcement systems.

This design attempts to limit the damage if an agent executes malicious instructions or if its sandbox is compromised. However, the security properties described by Google remain architectural claims rather than independently demonstrated protection against every possible attack.

Why Idle AI Agents Do Not Need Dedicated Active Compute

One of the largest infrastructure challenges for autonomous agents is that their execution patterns differ from those of conventional applications.

An agent may briefly execute a command, wait for a model response, pause for human input and then resume work. Reserving active CPU and memory resources throughout the entire session can be inefficient.

Agent Compute Engine addresses this problem with application-aware checkpointing. When the system detects that an agent has no active work, it can preserve the execution state and release active host resources until the next operation.

Google also uses copy-on-write memory sharing and pre-warmed snapshots. Common operating-system components, libraries and runtime data can be shared across multiple microVMs, while modified memory pages remain private to individual workloads.

The company says these mechanisms allow large numbers of persistent agent environments to share physical infrastructure efficiently. It has not published commercial pricing for the upcoming external service.

Agent Substrate Brings Related Technology to Kubernetes

Google also announced Agent Substrate, an open-source execution runtime designed for Kubernetes environments.

This is related to Agent Compute Engine but is not the same product. Agent Compute Engine is Google’s managed cloud execution service, while Agent Substrate is intended for platform teams that want to operate an agent-oriented runtime within Kubernetes infrastructure.

Google reports that Agent Substrate can deliver up to ten times greater compute density than traditional approaches. In a vendor-reported benchmark involving 200,000 agents, it sustained 500 activations per second with suspend and resume latency below 500 milliseconds.

These results refer specifically to Agent Substrate, not a published performance guarantee for Agent Compute Engine. Independent benchmark validation and complete test configurations have not been provided.

What the Announcement Means for AI Developers

For organizations building autonomous agents, the infrastructure question extends beyond choosing a language model.

Agents that execute code and interact with business systems also require controlled execution environments, storage, identity, networking and audit trails.

Google’s announcement suggests that these capabilities are becoming a distinct layer of cloud infrastructure rather than something every development team must assemble separately.

This direction is not unique to Google. As Servers.News previously reported, Meta’s Muse agent also uses dedicated cloud virtual machines to provide persistent execution environments.

The implementations differ, but both reflect the increasing importance of isolation and state management in autonomous computing.

Google is also extending its governance capabilities across services including Cloud Run and Google Kubernetes Engine. These controls aim to help enterprises manage agent identities, approved tools, network access and operational visibility.

For system administrators, the underlying principle is familiar: automated software should receive narrowly scoped permissions rather than unrestricted access to production infrastructure. This is also explored in the Servers.News guide to AI-assisted server administration.

What Remains Unknown Before the Customer Preview?

Although Google has provided substantial engineering details, several commercially important questions remain unanswered.

• Pricing: Google has not published prices or a complete billing model.
• Launch timing: The company targets a preview in the coming months without a specific release date.
• Regional availability: The initial customer regions have not been specified.
• Resource limits: Public customer-facing CPU, memory, storage and concurrency quotas have not been finalized in the announcement.
• Independent validation: Google’s performance and security claims still require evaluation under representative customer workloads.

What Happens Next for Google Agent Compute Engine?

The next milestone will be external developer access to Agent Compute Engine, followed by publication of the practical operating limits, supported regions and pricing.

Until those details are available, organizations should distinguish the system already deployed within Google from the forthcoming commercial preview.

The broader infrastructure shift is nevertheless clear. Autonomous AI services increasingly require more than model inference: they need persistent, isolated computing environments that can operate securely, pause efficiently and resume work at scale.

Google’s Agent Compute Engine represents a concrete attempt to make that execution layer a managed cloud capability, with virtualization and security becoming central parts of the AI-agent infrastructure stack.

This article is based on Google’s October 22, 2026, Agent Compute Engine announcement and engineering documentation, alongside independent coverage by The Decoder. Performance benchmarks and architectural security properties are identified as Google-reported claims. Commercial preview details remain subject to future announcements.