Every decade or so, a radical shift in software architecture forces the technology industry to rethink computing systems from the ground up. In the wake of the initial web-scale traffic explosion, Google pioneered warehouse-scale computing and Linux containers running on Borg, fundamentally transforming internal workloads and laying the groundwork for the modern cloud-native ecosystem through Kubernetes. A decade later, as deep learning models rapidly outgrew conventional compute and power paradigms, engineers returned to the drawing board to develop Tensor Processing Units (TPUs). As cloud security demands evolved to require robust, hardware-rooted guarantees, the company introduced Titanium, a custom silicon and Infrastructure Processing Unit (IPU) architecture designed to offload input/output virtualization, storage, and cryptographic trust directly from the host central processing unit.
Today, the technology sector finds itself in the midst of another foundational transition: the shift toward agentic artificial intelligence capable of moving beyond passive information retrieval to active execution. Across Google’s vast product ecosystem, AI agents are actively writing and executing complex codebases, operating external tools, navigating web browsers, orchestrating intricate enterprise workflows, and iterating autonomously on software repositories. In an extraordinarily short span of time, these agentic workloads have transformed into one of the most rapidly expanding consumers of compute power and storage capacity across the company’s global server fleet.
Traditional computing primitives, however, were never engineered to support hundreds of millions of autonomous agents operating simultaneously at a global scale while maintaining strict cost and latency constraints. Recognizing the necessity for a specialized form factor, Google developed the Agent Compute Engine, a new Google Cloud service that provisions a dedicated, hardware-isolated microVM for every active AI agent, offering container-speed agility while ensuring zero credentials are held within the sandbox environment.
The Engineering Challenges of Legacy Compute Paradigms
The inception of the Agent Compute Engine began with a deceptively simple objective outlined by the Gemini product team: to provide every user with a personalized, cloud-resident agent capable of remembering past interactions and executing tasks autonomously while the user is offline. To achieve this, each agent required a fully functional computing environment complete with its own filesystem, language runtimes, web browser, and secure network access. Concurrently, the Gemini for business division sought to empower corporate clients to deploy custom agents for their employees, capable of analyzing Workspace documents, querying internal databases, and invoking services confined within private corporate networks.
In addressing these requirements, engineering teams realized that standard agent architecture must be bifurcated into two distinct components. The harness, or the "brain," invokes the underlying AI model and determines the appropriate next steps, while the sandbox, or the "hands," executes the resulting shell commands, code blocks, and browser interactions. While development teams maintain complete trust in their proprietary harnesses, granting an AI model the operational capacity to interact with the digital world demands a secure, genuine computing environment.
Historically, traditional virtual machines have provided comprehensive operating system control, advanced networking, storage flexibility, and hypervisor-enforced isolation boundaries capable of supporting anything from standard web applications to enterprise databases. That flexibility, however, introduces severe performance overhead. Because each virtual machine boots and configures a complete operating system stack, the startup, suspension, and resumption processes typically require several seconds to full minutes. Because AI agents continuously start, pause, and resume throughout their operational lifecycles, this accumulated latency quickly degrades user experience.
Conversely, lightweight Linux containers share the host operating system kernel, offering extreme execution agility ideal for high-throughput environments. Yet, specific agentic use cases—such as automated software engineering assistants—demand absolute root-level control and rigorous workload isolation. Furthermore, preserving an agent’s working state is critical for efficient resource management. Tearing down the execution environment between conversational turns destroys the agent’s context and forces an expensive, time-consuming reconstruction on subsequent messages. Conversely, provisioning dedicated, always-on black-box virtual machines for every waiting agent leads to massive resource wastage. Google engineers concluded they required a hybrid paradigm: the ironclad isolation of a virtual machine combined with the speed and density of a container, supported by application-aware lifecycle management.
A Unified Architecture for Global Scale
Built from first principles as a unified compute platform, the Agent Compute Engine abstracts raw infrastructure into streamlined microVMs that instantly provision persistent, hardware-isolated environments. According to Gautham Thambidorai, Vice President and Google Fellow for Gemini, scaling autonomous agents globally requires infrastructure capable of rapid deployment and extreme operational efficiency. The microVM architecture delivers the exact responsiveness, workload density, and security isolation necessary to power interactive agent sandboxes for billions of users worldwide.
Security Architecture and Zero-Credential Sandboxes
As artificial intelligence agents evolve to manage complex software engineering tasks, email inboxes, and calendar schedules autonomously, the risk of malicious code execution within a sandbox environment remains a persistent threat. To mitigate this, Google designed the Agent Compute Engine around a rigorous defense-in-depth security model anchored by a foundational principle: assume an attacker controls everything inside the sandbox, and ensure they find no exploitable credentials.
In enterprise scenarios where an agent processes user communications—such as scanning an email containing hidden prompt injection instructions to exfiltrate API keys—relying solely on model safety instructions is insufficient. To eliminate this risk entirely, the Agent Compute Engine sandbox holds zero credentials. Outbound network traffic is intercepted by local node proxies, authenticated via hardware-backed cryptographic attestation through Titanium, and evaluated by off-node gateways before undergoing in-flight token swapping. Downstream backend services receive a cryptographically verifiable identity confirming the agent acted on behalf of a specific user, while the untrusted sandbox itself remains completely devoid of sensitive access keys.
Governance and Dynamic On-Behalf-Of Identities
Traditional cloud identity systems recognize only two distinct callers: human users and static software services. Autonomous agents fit neither category, operating dynamically as software entities acting on behalf of human users under constrained permission sets. To resolve the question of identity when an agent accesses protected corporate resources, the platform establishes four distinct architectural identities, ensuring the sandbox never holds the primary authorization key. Instead, the system relies on an exclusive Agent Workload Identity authenticated on the host, translating it to external identities only after rigorous validation of the user, node, and session compliance policies.
Intelligent Resource Management and Application-Aware Idle Detection
Data gathered from typical agent usage patterns reveals that AI agents spend the vast majority of their operational existence in an idle state, waiting for model inference responses or user inputs. Traditional hypervisors remain blind to whether a guest operating system is performing active computations or merely spinning in an idle wait loop.
By co-designing the sandbox command runtime with the host execution layer, Google introduced native application awareness. The exact moment an agent concludes a tool execution and enters its reasoning phase, the sandbox signals the hypervisor that no active commands are processing. The host instantly transitions the sandbox from active to idle via an optimized checkpoint-and-restore mechanism. This preserves the agent’s memory state while consuming zero active CPU resources, allowing a single physical server to host orders of magnitude more agent microVMs than conventional virtualization platforms.
Memory Deduplication and Rapid Forking
To manage high concentrations of agents executing identical base software images, the Agent Compute Engine leverages Direct Access (DAX) and Copy-on-Write (CoW) memory clones. By preloading warm snapshot images directly into physical memory, base operating system libraries and binaries are shared across every microVM on a host. Physical random-access memory is allocated exclusively for the minimal delta of private pages modified by individual agents.
Clement Farabet, Vice President at Google DeepMind, emphasized the significance of these capabilities for autonomous software development platforms like Antigravity. By providing instant snapshot-and-fork primitives and rapid resume speeds, developers can branch parallel code experiments instantaneously, transforming long-horizon software engineering workflows.
Global Scheduling and Strategic Availability
To optimize hardware utilization amidst fluctuating demand curves, Google deployed a globally unified scheduling engine. Consumer chat applications experience peak traffic during morning and evening hours, enterprise workloads peak during standard business hours across varying global time zones, and reinforcement learning or evaluation pipelines operate continuously without human-in-the-loop constraints. By routing deferred and asynchronous workloads—such as overnight code migrations, automated test sweeps, and deep background research—into off-peak operational windows, the platform absorbs uncorrelated demand spikes without requiring expanded physical hardware footprints.
Industry Implications and Availability
The introduction of the Agent Compute Engine marks a major milestone in cloud infrastructure evolution, addressing the complex trilemma of security, density, and latency inherent in autonomous agent deployments. By abstracting away the underlying infrastructure management while offering granular control over images, identities, and network configurations, Google Cloud is positioning this architecture as the foundational runtime for the next generation of enterprise software development. Google has announced that the Agent Compute Engine will be available for preview in the coming months, offering developers an enterprise-grade pathway to scale agentic applications from local testing environments to global production deployments.
