Google Cloud Launches Agent Compute Engine: Isolated VMs and External Gateways Secure AI Agents

On October 23, 2026, Google Cloud announced the launch of Agent Compute Engine, a new compute service designed specifically for AI agents. The service enables each AI agent to execute programs, operate browsers, and use external tools within independent, hardware-isolated micro-virtual machines, achieving strong isolation while maintaining fast startup times.

While traditional containers start quickly but share the host kernel, and traditional virtual machines offer isolation but suffer from slow recovery, Agent Compute Engine uses micro-VM technology to provide each agent with its own operating system environment. Crucially, Google separates the control program responsible for decision-making from the actual execution environment. Virtual machines do not store enterprise API keys or long-term login credentials. When an agent needs to access Google Workspace or internal corporate systems, connections must pass through an Agent Gateway, which verifies identity, user authorization, and access rights before injecting the required credentials. This design reduces the risk of sensitive credential theft if an agent is misled by malicious web pages or documents.

In terms of resource efficiency, the service supports pausing idle virtual machines to save compute resources, allowing multiple VMs to share read-only memory contents for common operating systems and tools. Each VM also has independent Hyperdisk storage to retain installed tools and work files, enabling agents to continue tasks across days without re-preparing the environment. Google stated that related technologies are already used in Gemini and internal model evaluations, with Agent Compute Engine expected to open for preview in the coming months for enterprises to run their own developed AI agents.