Google is preparing to ship Agent Compute Engine, the internal platform that already runs Gemini and Antigravity agents. A preview for Google Cloud customers is promised later this year, as announced at AGNTCon+MCPCon in San Jose.

The idea is straightforward: every agent gets its own hardware-isolated microVM that starts almost as fast as a container but is locked down like a full sandbox.

A persistent computer for each agent

Inside its microVM an agent gets root, its own guest kernel, a shell and a headless browser, and a work loop can run for weeks. The platform was also built for model eval runs, benchmarks and reinforcement learning.

Since agents mostly sit waiting on the model or the user, the host snapshots the VM after each tool call, so it uses no active resources until the next request.

Nothing worth stealing inside

Google's engineers assume an attacker may fully control the sandbox. So it holds no keys or passwords and has no regular network interface: traffic goes through an outside proxy, and real credentials are added only beyond the VM boundary.

Teams that would rather not rely on a managed service can use the open source Agent Substrate for GKE, which follows the same model. E2B, Daytona and AWS Bedrock AgentCore already offer similar sandboxes.

Our take

The real lesson is not about Google but about the principle: an agent that reads email and browses the web should never hold secrets inside its own environment. If you build bots with API access, keep the keys on a proxy or server side rather than in the agent's container. Details in The New Stack's article.