Google's Agent Compute Engine: A MicroVM Sandbox With No Credentials Inside, and What Google Has Not Shipped Yet

Google Cloud announced Agent Compute Engine on October 22. It gives each AI agent its own hardware-isolated microVM, and its main design rule is that the sandbox holds no credentials. The service is not generally available: Google says it will be in preview "in the coming months". What you can try today is the open-source Agent Substrate on GKE. I have not used either, and every claim below is Google's.

I read two primary sources: Introducing Agent Compute Engine and expanding agent governance and the engineering post Agent Compute Engine deep dive. I read the deep dive to its end. I also read the Agent Substrate repository page and README at github.com/agent-substrate/substrate. I did not read the code or the GKE docs, and I have not run it.

What it is

Per the announcement, Agent Compute Engine is a compute service built for agents that "already powers Gemini as an agent for work tasks". Google splits each agent in two: the harness, which calls the model and decides what to do, and the sandbox, which runs code, shell commands and a browser. The harness runs outside the sandbox.

Google says it needs the isolation of a VM and the speed and density of a container. Its stated answer is microVMs that boot fast, are paused when idle, and share memory pages across agents running the same base image.

The design choice worth copying: no secrets in the box

Google's rule is to assume an attacker controls everything inside the sandbox, and make sure there is nothing useful to find. The deep dive gives an example: an agent reads an email with hidden text telling it to find API keys and send them out. Google says it could not rely on models to ignore every such instruction, so it designed the sandbox to hold no credentials.

Per the post:

• No user credentials, API keys, OAuth refresh tokens or service account keys sit in the microVM's memory or disk, and there is no access to the metadata server.
• The microVM gets only an ephemeral, session-scoped SPIFFE certificate and a short-lived identity token.
• It has no standard network interface. Traffic goes through a point-to-point channel to a local proxy, then to an external gateway that checks scopes and enforces egress policy.
• The Agent Gateway swaps in the real backend credential on the wire as the request leaves, so the sandbox never sees it.

Four identities

The deep dive says an agent is neither a person nor a service, so it defines four identities: the user's identity, a delegated on-behalf-of grant held only in a central authorization service, a short-lived workload identity for the sandbox, and a workforce identity for agents that act with their own account. Only the workload identity is used for sandbox traffic, and Google says it cannot call a backend API directly if stolen. The gateway checks the user delegation, agent identity and node identity together before applying egress and data-loss policies.

Cost and speed claims

Google says it measured typical agent sessions and found agents spend most of their time waiting for the model or the user. So an idle microVM is checkpointed and costs nothing in active resources on the host, which Google says lets one node host "orders of magnitude" more live agent microVMs than conventional VMs. It also describes pre-warmed snapshot images mapped into memory with copy-on-write, and separate storage tiers: scratch overlays, shared read-only volumes and a persistent Hyperdisk workspace per microVM.

The deep dive gives no boot time, price or density figure for Agent Compute Engine itself. It says developers will control each environment's image, identity, network access and lifecycle, while Google manages the fleet, and that the service is targeted for preview in the coming months. The numbers in the announcement belong to Agent Substrate.

Agent Substrate: the part you can try

Agent Substrate is described as an open-source execution runtime for Kubernetes, available on GKE today, that works with any agent framework or harness, including Claude Code, OpenClaw and Hermes. Google claims:

Claim	Figure
Compute density vs traditional compute	Up to 10x higher
Benchmark with 200,000 agents	500 activations per second at under 500 ms suspend and resume
Isolation	microVM or gVisor, per-agent cryptographic identity, egress proxies that inject credentials outside the agent

These are Google's benchmark figures. The post does not give the hardware, workload or baseline. The repository README gives different numbers: resume in under 400 ms and more than 1,500 activations per second, and it describes 10x to 30x oversubscription. The two sources do not match, and neither gives its test setup, so treat both as unverified. Nous Research is quoted saying it uses the architecture to deploy multi-tenant agents into customer infrastructure. That is a vendor-chosen quote.

What the repository says

I read the README only, not the code. It says:

• License: Apache 2.0. The page showed about 5,800 stars and a creation date of May 13, 2026.
• Status: pre-1.0, with no backward compatibility guarantees. APIs and behavior may change significantly.
• Isolation: every actor runs in a dedicated gVisor or Cloud Hypervisor microVM sandbox. Plain Linux containers are not supported.
• Credentials: actors hold no identity tokens, API keys or cloud tokens. A built-in egress gateway injects credentials into approved outbound requests, and the policy point is replaceable.
• Networking: default deny, with no lateral actor-to-actor access.
• Kubernetes support: the latest stable release and the previous minor release.
• It says it is a runtime, not an agent SDK, and lists ADK, LangChain, Claude Code, Codex, Antigravity and MCP servers as compatible workloads.

The pre-1.0 warning matters. "Available on GKE today" is true as an open-source project, not as a stable product.

Governance announcements

The same post expands Gemini for business agent governance: Agent Gateway, Agent Registry, Agent Identity based on SPIFFE, and OpenTelemetry-based observability. Google says coverage extends across Agent Runtime, Cloud Run, Agent Sandboxes, GKE and Agent Compute Engine (preview). Items marked "in preview soon" are cross-cloud Envoy-based enforcement and governance for local coding agents such as Claude Code and Antigravity CLI on managed devices. Items marked "coming this quarter in preview" include token and cost governance, model routing policies and extensible policies. None of these are things to rely on today.

What I would check

These are my own untested suggestions.

1. Try Agent Substrate in a test cluster first. It is the only open piece. The README has a kind-based quickstart and a counter demo. Expect breaking changes, since it is pre-1.0.

2. Ask what "preview" includes. No dates, regions, quotas or pricing are given for Agent Compute Engine.

3. Apply the principle without the product. The no-credentials-in-the-sandbox rule can be tested on your own stack. Check what secrets your agent sandbox can reach, including the metadata server and environment variables.

4. Test egress control. Try to make a sandboxed agent call a domain it should not reach.

5. Reproduce the benchmark at a smaller scale before trusting the 10x density claim.

6. Check what lock-in the gateway brings. The token swap and identity checks rely on Google's Agent Gateway.

What I would not conclude

• That it is available. The announcement says preview in the coming months.
• That zero credentials means zero risk. Prompt injection can still misuse whatever the agent is allowed to do through the gateway.
• That the 200,000 agent figure applies to your workload.
• That this works outside Google Cloud. Agent Substrate is portable by Google's claim, but Agent Compute Engine is a Google service.

Frequently asked questions

What is Agent Compute Engine?

A Google Cloud compute service that gives each AI agent its own hardware-isolated microVM, announced October 22 and said to already power Gemini's agent for work tasks.

Is it available now?

No. Google says it will be in preview in the coming months.

What is Agent Substrate?

An open-source, Kubernetes-native agent execution runtime on GKE that Google says gives up to 10x higher compute density and runs any agent harness.

How does it keep secrets safe?

The sandbox holds no credentials. An external gateway checks identity and policy, then inserts the real credential into the request outside the sandbox.

What identities does an agent have?

Four, per the deep dive: user, delegated on-behalf-of grant, workload identity and workforce identity.

Does it work with Claude Code?

Google says Agent Substrate works with harnesses including Claude Code, and that governance for local coding agents like Claude Code is coming in preview soon.

How much does it cost?

The posts I read give no pricing.

Sources

• Google Cloud Blog, Introducing Agent Compute Engine and expanding agent governance (October 22, 2026): product overview, Agent Substrate claims and governance roadmap.
• Google Cloud Blog, Agent Compute Engine deep dive (October 22, 2026): security design, identities, idle handling, storage and availability. Read in full.
• Agent Substrate repository README (read October 26, 2026): license, status, security model and performance claims. Code not read.