Google Cloud Launches Agent Compute Engine: Hardware-Isolated microVMs, No Credentials Inside the Sandbox
Google Cloud’s Agent Compute Engine, launched at AGNTCon + MCPCon on October 22, redraws the security perimeter for production AI agents. Instead of embedding API keys, OAuth tokens, or service account credentials inside an agent runtime, the service isolates each agent in a single-tenant hardware microVM and gives it only a short-lived SPIFFE cryptographic identity. Real credentials are never inside the sandbox — they are substituted at the network egress point by an external Agent Gateway.
How the isolation works
Each agent gets its own microVM, not a container. The isolation is hardware-backed through Titan security chips and Titanium IPUs, which handle trusted boot, network, and storage separation. Startup and resume times are close to container-speed — not the seconds typical of full VM cold starts — while maintaining persistent working state across calls.
The SPIFFE (Secure Production Identity Framework For Everyone) identity model is the security core. Instead of a fixed secret that can be leaked or rotated lazily, agents receive a short-lived certificate tied to the specific workload and revoked automatically at session end. When an agent needs to call an external API, the Agent Gateway receives the request, retrieves the real credential from a store outside the sandbox, and proxies the call. The agent never sees the token it used.
What it covers
The architecture addresses a failure mode that has shown up repeatedly in production agent deployments: an agent holding a persistent API key or OAuth token becomes a lateral-movement risk if it misbehaves or is compromised. Tool-using agents frequently need broad read/write access — to calendars, code repositories, email, file stores — which is precisely the access that makes credential leakage expensive.
Agent Compute Engine already runs Gemini personal agents inside Google’s own infrastructure. A developer preview is expected to open in the coming months; pricing has not been announced.
The Titan and Titanium IPU integration puts the security layer at silicon, not software — an architecture carried over from Google’s Confidential Computing program. The service launched alongside MCP tooling updates and agent orchestration sessions at AGNTCon, placing it in the context of a broader infrastructure buildout for autonomous agent workloads.