Google Cloud Agent Compute Engine Review: MicroVM Sandboxes, Governance and Cross-Cloud Security Features

Google Cloud Agent Compute Engine supplies single-tenant microVMs for running AI agents in isolated environments. Announced on October 22, 2026, the service targets workloads such as code execution, browser tasks, persistent coding workspaces, and large-scale evaluations. It already supports Gemini models along with internal Google reinforcement learning pipelines.

Each session receives its own microVM built on Cloud Hypervisor. The design grants a dedicated guest kernel, root access, and Hyperdisk storage for context and files. Hosts incorporate Titan silicon and Titanium IPU to enforce hardware-rooted attestation, storage mediation, and line-rate encryption.

Google Cloud Agent Compute Engine Features and Architecture

MicroVMs boot rapidly and share memory across agents through copy-on-write templates. Application-aware idle detection pauses sessions via checkpoint and restore, returning near-zero active resource use while preserving full state. Networking stays restricted: no standard vNIC access exists, and all traffic routes through a mediated Agent Gateway that performs policy checks and token swaps.

The zero-secrets model eliminates persistent credentials inside microVMs. Short-lived SPIFFE-based identity tokens arrive only through a per-VM listener. End-to-end encryption covers data in transit and at rest, while CPU side-channel mitigations remain active. Governance ties directly into the Gemini Enterprise Agent Platform, covering policy enforcement, egress controls, observability via OpenTelemetry, and four identity types: user, delegated on-behalf-of, workload, and workforce.

Cross-cloud extension uses lightweight Envoy proxies to apply the same gateway, registry, and identity controls to other clouds, on-premises systems, and local agents such as Claude Code. An open-source Kubernetes runtime called Agent Substrate, which supports microVM and gVisor options, is already available on GKE for evaluation use. Benchmarks for the substrate show up to 10x density gains and 500 activations per second with suspend-resume times under 500 milliseconds across 200,000 agents.

Availability, Limitations, and Competitor Comparison

Customer preview access opens in the coming months after the announcement, though no regions, exact launch date, or pricing details have been released. An expression-of-interest form exists on the Google Cloud site. Workload targets focus on interactive agents and large evaluation runs rather than general-purpose compute.

Limitations include the absence of published pricing, limited production regions, and reliance on preview components for cross-cloud governance. The service does not provide standard metadata server access or long-lived tokens inside microVMs, which may require workflow changes for some agent frameworks. Agent Substrate remains marked for non-production use only.

The table below compares core attributes with two established alternatives.

User feedback on early internal deployments highlights strong isolation for untrusted agent code and efficient snapshot handling during evaluations. Common complaints center on the lack of direct networking flexibility and the need to route all external calls through the Agent Gateway. No widespread public reviews exist yet because the service has not reached general availability.

Google Cloud Agent Compute Engine review sources confirm the focus on hardware-rooted trust and session-scoped identity. Organizations evaluating agent platforms should examine their tolerance for gateway-mediated traffic and the current preview status before planning production workloads.