Google Introduces Agent Compute Engine for Hosting AI Agents

On October 22, 2026, Google LLC announced the Agent Compute Engine – an infrastructure service for hosting AI agents. The announcement took place at the AGNTCon + MCPCon conference. The service creates an isolated micro-VM for each agent, where credentials are absent, and tasks are executed in secure sandboxes.

Google claims that the technology combines the efficiency of containers with the security of virtualization. Devices do not permanently store agent files; data is kept in an immutable file system, firmware integrity is verified by Titan chips, and processors are protected from side-channel attacks. Micro-VMs have limited access to storage, so capturing one sandbox will not allow reading or deleting data. All traffic passes through several proxies: from the micro-VM through a local intermediary to an external gateway, which checks request scopes and ensures outbound routing.

AI applications often suspend agents, and idle sandboxes consume resources. Google claims that the service detects idleness, disables the sandbox, and restores it from a snapshot when needed. This allows a single physical node to host orders of magnitude more active micro-VMs than regular virtual machines. Density is achieved through shared memory usage: warmed images are mapped via DAX, and only the modified pages of each agent occupy private memory. Storage is divided into ephemeral overlays, shared read-only volumes, and persistent workspaces on Hyperdisk.

Credentials are stored outside the sandbox, and the Agent Gateway service retrieves them and sends them on behalf of the agent. Google assumes that an attacker controls everything inside the sandbox, so after a prompt injection, the agent will not find secrets to steal.

Google defines four agent identities: user, delegated, Agent Workload Identity (a short-term SPIFFE identity, unique for sandbox traffic), and Agent Workforce Identity. The workload identity is useless for direct API calls in case of leakage – it only indicates which sandbox sent the packet.